feat: add Symphony autonomous development pilot

[douglasmonsky]

Summary

• What changed: added a pinned Symphony pilot contract, restricted Codex profile integration, autonomous issue form, lifecycle skill, per-user service scripts, structured status command, and operating/security/validation docs.
• Why it changed: prove a conservative GitHub issue-to-isolated-workspace-to-PR workflow without coupling Symphony to the repository task broker.
• User/developer impact: maintainers can explicitly opt reviewed issues into one-worker autonomous delivery and retain manual intervention through Codex Desktop.
• Prerequisite repairs: marked the already-merged TypeScript publication plan complete after verifying its PRs, publish run, and PyPI release; refreshed GitPython 3.1.52 to 3.1.55 after the required audit found new advisories.

Post-review hardening

• The public issue form now creates an unlabelled candidate; a trusted maintainer must separately apply agent-ready.
• The dedicated Codex login is in the OS keychain, and startup refuses any ~/.codex-symphony/auth.json file or symlink.
• The Git bridge requires an empty index, literal explicit paths, an exact staged set, and cleanup after rejected publication.
• Status aggregation reads verifier checks and reports outcome, run ID, profile, and blocked timestamps.
• Start/stop use the dedicated CODEX_HOME, a fixed launch label, and registered job identity checks.

Verification

• Focused tests: skill validation, Bash syntax, ShellCheck, YAML/issue schema, Markdown lint, Git bridge negative paths and index cleanup, keychain/file boundary, start/stop identity, dashboard API, and local rendered capture.
• Agent Maintainer profile(s): final scripts/verify (full) passed, run 20260724T213025922634Z-full-e86d4ca09d78.
• Live exercises:
  • [Agent]: Document dashboard WebSocket troubleshooting #424: isolated branch, one-file edit, focused/full verification, commit and push passed; a controlled retry opened delivery PR docs: document dashboard WebSocket troubleshooting #426 and moved the issue to human-review.
  • [Agent]: Blocked-state pilot — terminology decision intentionally withheld #425: intentional unresolved terminology choice escalated cleanly to agent-blocked with no file changes.
  • Desktop intervention: codex app <workspace> opened the preserved [Agent]: Document dashboard WebSocket troubleshooting #424 workspace successfully.

Contributor Checks

• I read CONTRIBUTING.md and CODE_OF_CONDUCT.md.
• This change contains no credentials, private data, or identifying records.
• User-facing behavior is reflected in documentation; no application API or release behavior changed.
• Security-sensitive details are documented without credentials.

Cohesive-Change Override

• Override requested: yes
• Why one cohesive unit: the issue contract, runtime workflow, worker skill, service controls, observability, and operations guidance form one pilot safety boundary.
• Why smaller PRs would make repository less coherent: the first worker must clone one branch where all contracts agree; partial merges would be un-runnable or misleading.
• Tests/verification proving behavior unchanged: the full repository profile passed; the pilot is opt-in through a separately applied agent-ready label.
• Behavior change: adds opt-in autonomous repository delivery; it does not alter application runtime or production data.

Pilot Limits

• Keep concurrency at one and all optional MCPs disabled.
• Do not auto-merge.
• The one-file run used 2.26M aggregate input tokens (95% cached, 113k non-cached) across 47 model calls, which is not an acceptable steady-state cost. Equivalent failed external mutations are capped at one retry.
• Merge review should explicitly note the stale TypeScript plan correction and GitPython security refresh as prerequisite governance repairs.
• Before expansion, merge this setup PR, complete two more bounded tasks below an agreed token/call budget, use a repository-only GitHub identity, and separately prove any optional MCP in an isolated workspace.