[CI] Define penpot-design-executor operational contract

[egdev6]

Summary

Define the operational contract for a penpot-design-executor agent that can verify runtime dependencies, open Penpot targets, apply allowed edits, export artifacts, and report structured results back to the orchestrator.

Scope

• runtime checks for Docker, Penpot, and MCP
• target file/page localization
• allowed actions:
  • rename
  • move
  • group
  • export
  • report
• structured input/output contract

Acceptance Criteria

• input and output contracts are documented
• execution states ok|warning|blocked are defined
• the executor is ready to be delegated by the orchestrator

Tasks

• document input contract
• document output contract
• define preconditions and runtime checks
• define execution modes (read-only, edit-approved, etc.)
• define allowed and forbidden actions
• define the orchestrator delegation prompt
• validate compatibility with MCP and the Penpot skill

Additional notes

The executor should coordinate runtime and actions, not replace design-system rules or orchestration.