Add SDLC pointer manager and guarded-run wrapper (closes #19)

[jmjava]

Summary

Implements #19: a persistent SDLC chore/task pointer with guarded execution wrappers so agents refuse to run commands against the wrong Work ID.

Added

• agent-context/sdlc-pointer.sh — pointer get/set/reset, run_against_pointer, and CLI aliases (set, get, reset, init, run, plus /sdlc-set-pointer style names)
• Pointer state stored in .sdlc/pointer (gitignored as local agent state)
• flock-backed reads/writes with atomic temp-file fallback when flock is unavailable
• Safer quoting than the issue draft (pointer values passed via bash -c args instead of interpolated into flock command strings)

Wired into framework

• init-project.sh / upgrade-project.sh — ship the script to target projects
• start-agent-session.sh — sets the pointer when --work-id is provided
• verify-project-install.sh — checks for executable agent-context/sdlc-pointer.sh
• agent-context/README.md — usage snippet and examples

Tests

• tests/test-sdlc-pointer.sh — CLI round-trip, guarded run, sdlc_init override, session integration, init install
• .github/workflows/test-sdlc-pointer.yml — CI regression gate

REASONS Canvas

• Work ID: n/a (framework infrastructure)
• Canvas path: n/a

Checklist

• Canvas updated or synced — n/a
• One operation per coding session respected
• Tests added or updated
• Review completed
• Safeguards respected
• CI gates pass (validate-command-adapters, test-adapter-install, validate-canvas, validate-diagrams, test-sdlc-pointer)
• If command/prompt adapter files changed, ran adapter parity validation — n/a

Manual Smoke (Required for high-risk changes)

• Manual chat smoke executed — not required; shell-only infrastructure change
• verify-agent-command-effects.sh — n/a
• Milestone/session-notes sync — n/a

Test Plan

• ./tests/test-sdlc-pointer.sh (7 assertions, all passing locally)
• bash -n on modified shell scripts