Phase-1 CI/CD artifacts generated on code branch are never committed (orphaned on local disk until manually discovered)

## Summary

During a greenfield run, the Phase-1 **devops-engineer** CI/CD setup step generates code-branch artifacts (`.github/workflows/ci.yml`, `release-sign.yml`, `.tool-versions`) on the `main` working tree, but **no agent ever commits them**. They remain as untracked files on local disk — unbacked-up and unpushed — until a human happens to notice. In our run they sat orphaned for ~19 hours and were only discovered by accident while committing unrelated work.

## Environment

- vsdd-factory plugin (claude-mp marketplace), greenfield mode
- Project layout: `.factory/` mounted as a git worktree on the `factory-artifacts` orphan branch; code lives on `main`
- Phase at time of discovery: Stage-0 hardware spike gating Phase 2 (pre-Phase-3)

## Root cause

The factory's **state-manager commits only to the `factory-artifacts` orphan branch.** The devops-engineer's CI/CD step correctly places `.github/` + `.tool-versions` on the **`main` code branch** (per `cicd-setup.md` §"Branch Placement Note"), but nothing in the pipeline ever commits the `main`-side artifacts. The result is generated-but-uncommitted files with **no git backing on any branch**.

The factory is *aware* of the hazard — `cicd-setup.md` explicitly states:

> The `.github/` directory and its workflow files must live on the **code branch** (`main`)... The state-manager or a human must ensure these files are committed to `main`... **This concern should be flagged to the state-manager before the first git push.**

…and STATE.md records `.github/ files pending PR into main`. But this is **prose intent, not an enforced action.** No PR was opened, no commit was made, no gate verified it. The single safety net — the orchestrator's documented "Pre-Phase 3: CI/CD verification (ci.yml exists, branch protection configured)" mandatory gate — had not fired because the run was still pre-Phase-2. So between artifact generation (Phase 1) and the Phase-3 gate, the artifacts have **zero protection** and exist only on one machine's working tree.

## Evidence

- `git log --all --oneline -- .github` → empty (files never committed to any branch until manually PR'd ~19h later)
- Filesystem mtime of `ci.yml` / `release-sign.yml`: Jun 27 10:08–10:09; first commit: Jun 28 ~05:50 (manual)
- `cicd-setup.md` (producer: devops-engineer) lines 272–293 document the placement requirement as a prose note
- STATE.md: `phase-1-cicd-setup | PASSED | ... .github/ files pending PR into main` — marked PASSED despite artifacts being uncommitted
- `gh api repos/.../branches/main/protection` → 404 (branch protection from `cicd-setup.md` §Branch Protection also never applied)

## Impact

- **Data-loss risk:** generated CI artifacts live only on local disk with no remote backup for an unbounded window (Phase 1 → Phase 3). A `git clean`, disk failure, or fresh clone loses them silently.
- **Silent CI absence:** GitHub Actions never runs because workflows aren't on `main`; the project believes CI is "set up" (STATE says PASSED) while no CI exists on the remote.
- **Hidden until late:** the gap is invisible until the Pre-Phase-3 gate or accidental discovery — potentially many phases after the artifacts were produced.

## Suggested fixes

1. **Commit code-branch artifacts at generation time.** When devops-engineer produces `main`-branch files, the orchestrator should immediately dispatch a commit/PR for them (a `chore: CI/CD setup` PR into `main`) rather than deferring to a prose note. The factory already mandates "never write directly to main" → this should be an automatic feature-branch + PR step at end of `phase-1-cicd-setup`.
2. **Don't mark `phase-1-cicd-setup` PASSED while its artifacts are uncommitted.** The gate's PASS criterion should require the artifacts to be committed/pushed (or a tracked PR open), not merely created on disk.
3. **Apply branch protection in the same step**, or explicitly defer it with a tracked action item rather than a recommendation in a doc.
4. **Detect orphaned code-branch artifacts.** A factory-health check could flag untracked files on the code branch that match known-generated patterns (`.github/`, `.tool-versions`, `deny.toml`) and warn that they are unbacked-up.

## Workaround applied in our run

Filed the orphaned artifacts into a `chore: project scaffolding` PR manually (signed commit, feature branch → PR into `main`). Note: CI on that PR fails fmt/clippy/build/test because there is no crate on `main` yet (pre-implementation) — expected; will go green once Phase-3 code lands. Branch protection still pending.