Complete Workshop architecture-reset contracts

[kcsfelty]

What changed

• makes Workshop the authoritative 52-operation MCP catalog and executable assembly boundary
• completes authorization administration, canonical CNF visibility behavior, search filtering, audit/revision, restart, backup, and legacy-owner contracts
• adds exact bounded gnolith_status.semanticState.diagnostic v1 evidence and downstream fixtures
• binds the corrected Taproot 0.5 candidate and expands packed SQLite/Qdrant qualification

Why

The architecture reset requires one Workshop-owned data plane with truthful discovery, stable authorization semantics, secret-safe readiness evidence, and immutable downstream contracts. Final black-box review also showed that two singleton visibility clauses were being misread as OR, although canonical CNF makes clauses AND and atoms within each clause OR.

Impact

Downstreams receive one 52-tool catalog, a versioned status diagnostic envelope, stable validation for caller-hidden visibility policies, and assembled restart/search/audit coverage. No package is published or tagged by this PR.

Validation

• format, lint, typecheck, build, pack, production audit
• 21 test files / 134 tests
• repository readiness and Node/SQLite parity
• performance and developer-security gates
• packed assembled MCP with SQLite and real Qdrant
• canonical visibility rejection/acceptance, enabled reader credential, filtering, restart, audit, search, and status fixtures
• exact missing-tag release boundary