[P1] Enforce Concord Loom self-dogfooding for repository changes

[PullDakar]

Outcome

Make Concord Loom use its own governed workflow for every substantive change to Concord Loom itself.

Policy direction

• Humans define intent, accept consequential decisions, and authorize activation or publication.
• AI agents are the default implementation route.
• Deterministic automation remains valid for deterministic checks.
• Every source-changing contribution is represented by an authorized Concord Loom run.
• A human-authored patch may be converted into a governed run by a maintainer.
• Recovery work uses a minimal explicit recovery run; it does not bypass governance.
• This self-hosting rule applies to Concord Loom, not automatically to downstream projects.

Surfaces

Update AGENTS.md, both contributing guides, the pull request template, and machine-verifiable checks. Keep the Code of Conduct focused on community behavior.

Success criteria

• Policy distinguishes human authority, agent execution, and deterministic automation.
• English and Russian contributing guides remain semantically aligned.
• Pull requests identify run card, candidate, verification evidence, and publication boundary.
• CI rejects missing or inconsistent required receipts where enforceable.
• A recovery lane remains fail-closed and auditable.
• Contributors can still open issues and propose patches without running agents locally.
• At least one repository change dogfoods the policy end to end.