docs(branching): adopt trunk-on-main default

[ss-o]

Closes #551

Summary

• accept ADR 0019: trunk-on-main is the organization default and zi is the sole named persistent-integration exception
• move class-1, class-2, and class-3 CI and settings language onto the actual integration and publication boundaries
• require ancestry-preserving merge-commit promotion for zi, with no routine back-merge or branch rewrite
• replace stale branch-protection and release procedures, update onboarding, dependency, bootstrap, security, template, and scoped instruction surfaces
• update the repository-settings audit with the zi linear-history override and make class-3 CI required when CI exists
• retire the unused promote-prepare.yml draft, which was superseded before any caller adopted it

Decision

wiki, src, zsh-lint, and zsh-eza migrate to trunk-on-main. zi keeps next as its integration branch and promotes it to stable main only with a merge commit. A persistent integration branch in any future repository requires an explicit ADR amendment.

Instruction impact review

1. Classification: shared policy, scoped guidance, workflow enforcement, and the read-only repository-settings audit all change.
2. Consumers: Codex, Claude Code, Copilot, Gemini CLI, human maintainers, CI, every repository using the organization baseline, and the five repositories named by the superseded policy receive the change.
3. Canonical owner: decisions/0019-trunk-on-main-default.md is the canonical branch-model owner. AGENTS.md, scoped instructions, runbooks, templates, and audit data derive from it.
4. Duplicates or contradictions: ADRs 0008 and 0016 are retained as historical records and marked superseded. The old squash-promotion, forced realignment, class-1 development-branch, and global next branch-enforcement contradictions are removed.
5. Manifest routing: .github/instruction-surfaces.json adds ADR 0019 for architecture, branch protection, repository bootstrap, and release tasks. No adapter route changes are needed.
6. Runtime delivery: every supported runtime receives the branch rule through canonical AGENTS.md and the required manifest surface. No optional hook, skill, or plugin owns the rule.
7. Generated output and limits: the public validator, 83 public unit tests, Trunk checks, actionlint, JSON parsing, Ruby syntax, 35 settings-audit tests, and git diff --check pass. The private composite will be regenerated and validated as a separate gitlink-aware workspace step after this public change lands.

Validation

• python3 scripts/validate-agent-policy.py
• python3 -m unittest scripts/test_validate_agent_policy.py -v
• ruby -c scripts/repo-settings-audit.rb
• ruby -c scripts/test-repo-settings-audit.rb
• ruby scripts/test-repo-settings-audit.rb
• actionlint .github/workflows/*.yml
• scripts/trunk-safe-check.sh -- check --no-fix
• git diff --check

Follow-through

The parent issue #550 tracks coordinated src, wiki, zsh-lint, zsh-eza, zi, live ruleset, branch-retirement, deployment-environment, wiki documentation, and private composite completion. This PR establishes the canonical policy required before those repository changes are applied.