feat(workflow): add safe native role pipeline

[Thibault1818]

Summary

• add an explicit Supervisor -> Implementer -> Reviewer CLI workflow, with an optional Adviser bounded to one call
• send objectives and all role prompts through stdin, and print the resolved target, models, checks, permissions, and attempt bounds before confirmation
• implement in a real Git worktree, run lockfile-based install plus repository typecheck/tests and git diff --check, review the exact commit/diff hash, and revalidate target branch/SHA immediately before merge
• fail closed on unsupported transports, invalid role output, failed/interrupted checks, stale implementation evidence, non-descendant commits, Reviewer rejection, or target drift

Native integration evidence

test/integration/native-role-workflow.test.ts launches the real ORCH TypeScript CLI as an OS subprocess. It places deterministic local executables named codex and claude on a temporary PATH; production code starts them through its normal spawn path. Each scenario creates a real temporary Git repository with a commit, real branches, a linked git worktree, real implementation commits, quality commands, and merges. HOME, TMPDIR, npm state, and proxy variables are isolated; no model account or network is used.

Covered scenarios:

• direct Supervisor/Implementer/Reviewer success with Adviser absent
• optional Adviser called exactly once
• real worktree creation and cleanup, implementation file/commit, checks, and merge
• failed test blocks merge
• target branch advance blocks merge
• Reviewer process failure and explicit rejection block merge with exact attempt accounting
• invalid structured output consumes a failed attempt before one bounded retry
• confirmation refusal starts no role subprocess
• objective/prompt sentinels are absent from every subprocess argv and present only on stdin
• implementation outside the recorded target history is rejected

Checks

• npm ci --ignore-scripts
• npm run typecheck
• npm test -- test/unit/domain/native-role-workflow.test.ts test/integration/native-role-workflow.test.ts (16 passed)
• npm test (129 files, 2107 passed, 2 skipped)
• npm run build
• npm audit (0 vulnerabilities)
• git diff --check

Scope and limits

• Supported workflow bindings are Codex for Supervisor/Reviewer and Claude for Implementer/optional Adviser. Other adapters, including Grok and Antigravity, are unchanged and rejected only by this command until safe stdin transport is established.
• The target repository must use exactly one npm lockfile and define typecheck and test scripts; optional lint is also run. Lifecycle scripts are disabled for dependency installation and quality-script invocation.
• This PR does not change existing adapters, goals, TUI, dependencies, package identity, npm publishing, repository/security links, or generated dist files.