Implement Cockpit domain and governance foundations

[smota]

Summary

• Implements Cockpit foundations plus MVP server/UI slice: domain model, GitHub issue/comment mapping, read model, Goal Board, Issue SDLC View, Evidence Health, GitHub client, GitHub OAuth callback/session skeleton, authz policy helpers, guarded action gateway, audit events, and docs.
• Keeps GitHub as durable truth and .agent-runs//runner telemetry optional.
• Keeps Docker out of this pass while preserving env/config and /healthz boundaries for future container deployment.

Issues

Implements #120
Implements #121
Implements #122
Implements #123
Implements #124
Implements #125
Parent: #119

Workflow evidence

• Launcher: pi parent
• Executor: pi parent
• Transport: local CLI/tools
• Branch: feature/119-agentflow-cockpit-plan from development
• Commits: 2ea3b06, 4f55f67, d27dcb5

Validation

• pnpm test — passed, 120 tests
• Cockpit smoke: spawned node scripts/cockpit-server.mjs with AGENTFLOW_REPOSITORIES=smota/agentflow-sdlc, GITHUB_TOKEN=dummy, COCKPIT_PORT=3981; GET /healthz returned 200 {"ok":true}
• Targeted Prettier for changed source/docs — passed

Note: full pnpm format:check remains polluted by untracked .pi-subagents/ artifact files from council runs; source files added in this PR were formatted directly.

Agent review

• Self-review only. Remote auth/write surfaces should still receive human security/acceptance review before release.
• No Albert code copied; implementation is original and follows AgentFlow principles.

Follow-ups

• Docker image/deployment intentionally second pass.
• Production hardening still recommended before public exposure: persistent session store, complete CSRF token plumbing for browser forms, GitHub App option, rate limiting, security headers, and end-to-end OAuth tests against a test app.