fix(instructions): reconcile organization agent policy

[ss-o]

Summary

• reconcile stale and contradictory organization instruction surfaces with
  their canonical policy owners
• record maintainer acceptance of ADR-0015 while preserving separately scoped
  repository enrollment
• add portable worktree policy, routing, validation, and runbook coverage
• align Trunk and Gitleaks execution with the current pinned runtime
• integrate the latest origin/main dependency and CI changes

Closes #493.

Instruction impact review

1. The change covers shared policy, scoped guidance, runtime adapters, and
   enforcement.
2. Codex, Claude Code, Copilot, Gemini compatibility adapters, humans, public
   standalone clones, and the validated private composite receive their
   applicable rules.
3. AGENTS.md, routed instructions, runbooks, ADRs, and validators retain
   distinct canonical ownership.
4. Stale duplication and contradictory tool, testing, branch, security, and
   plugin guidance are removed or redirected to canonical owners.
5. The public manifest and private generated routing are reconciled together.
6. Mandatory behavior remains available without depending on optional skills,
   hooks, or agents.
7. Generated outputs, validators, routing evaluation, and size limits pass.

Verification

• python3 scripts/validate-agent-policy.py (83 tests passed)
• python3 scripts/validate-zsh-standard-policy.py (98 tests passed)
• sh scripts/test-trunk-safe-check.sh
• sh scripts/test-trunk-safe-ci.sh
• Actionlint on the changed workflow files
• Gitleaks through the pinned Trunk runtime
• git diff --check

The private composite and dependent child changes were also validated locally;
they will be published separately after this canonical policy change lands.