Make canonical TypeScript work verifiable

[drevendev]

Closes #14 — the policy half. The product half merged as #15.

Achieved outcome

Canonical TypeScript work now has a required check behind it, and both runbooks, the
working contract and the structural guard describe a repository that holds two
runtimes with different jobs. Without this, the first M0 unit of work would have
arrived with no evidence and the acceptor would have been right to refuse it forever.

Changed artifacts

Artifact	Change
.github/workflows/ci.yml	new typescript job: npm ci, typecheck, test, build on Node LTS
AGENTS.md	the two runtimes and their different jobs; verification for both
docs/zendev/AUTHOR_RUNBOOK.md	both suites; FILE carries its extension; READY/FROZEN only; P0 to priority:high, P1 to priority:normal
docs/zendev/ACCEPTOR_RUNBOOK.md	verification commands for both runtimes
scripts/policy_guard.py	src/ is product code
scripts/tests/test_policy_guard.py	two tests covering that
docs/adr/0002-...md	what came from the specification, what the implementer chose
docs/spec/FEEDBACK_TO_RESEARCHER.md	the three interoperability defects and their resolution

Worth knowing about the sequence

This change had to be split from #15, and the guard is what forced it: a diff holding
both AGENTS.md and src/index.ts is refused, so the toolchain had to land before the
policy that describes it. The ordering was not planning — it was the control firing on
its author. That is the intended behavior.

Acceptance criteria (remaining half of #14)

• CI runs the TypeScript checks on every pull request
• The .NET checks are unchanged and still required
• AGENTS.md and both runbooks name both verification paths
• policy_guard treats src/ as product code
• An ADR records which choices came from the specification and which did not

Checks

Check	Outcome	Evidence
python -m unittest discover -s scripts/tests	passed	20 tests, 0 failures
npm run typecheck, npm test	passed	2 tests, no type errors
policy_guard --base origin/master	passed	8 files, all policy or neutral, no product path
ci.yml parse	passed	jobs: build-and-test, typescript, policy-guard
The typescript job itself	not_run locally	first execution is on this pull request

Not checked

Whether npm ci behaves on a clean Linux runner with lts/*. It worked on Node
24.19.0 on Windows with a committed lockfile; the checks tab on this pull request is
the actual evidence.

Highest-risk area for review

The claim that both suites are required. Adding a job to ci.yml does not make it
required — branch protection has to list it. That is a repository setting, not a
file in this diff, and it is the remaining gate below.

Remaining gate

After merge, typescript must be added to the required status checks on master.
Until then the job runs but does not block, so a red TypeScript check could still be
merged. Once it is in place, arming the schedules is the last step.

🤖 Generated with Claude Code