design(harness): audit and contract the Agent/Skill knowledge system

Parent: #438

Produce the target architecture and executable child-task graph for WorkspaceX development Agents and Skills. This is design/audit work; do not bulk-install third-party code or implement product runtime.

Required outputs:

1. A five-subsystem harness audit snapshot focused on instructions, templates, state/identity, scripts/generation and verification/evals.
2. Agent topology separating persistent coordinators/workers/reviewers from ephemeral research/planning/test subagents. Include least privilege, reports-to, queue ownership, concurrency and independent-review separation.
3. Skill taxonomy separating process, module/domain, tool adapter, incident/runbook and product capability Skills.
4. Experience-promotion lifecycle: issue/PR evidence → lesson candidate → curator decision → Skill/ADR/instruction/test → cross-model eval → reviewed release → deprecation.
5. Supply-chain schema and quarantine flow with source repo/commit/subpath/hash/license, permission/risk tier and update review.
6. A collision/gap audit of all 18 current Skills and 8 generated subagents, plus live Directory roles.
7. A selected adoption matrix for Agent Skills spec, Superpowers, GitHub Spec Kit, AGENTS.md, Anthropic/OpenAI examples and Deep Agents/OpenHands patterns: adopt, adapt, reference only or reject, with reasons.
8. Child GitHub issues ordered by dependencies and same-file hotspots. Reuse #436 for portable role generation.

Mandatory policy decisions:

- GitHub durable evidence + coord-service task/lease/presence are authoritative; Claude/Codex private messaging is never authority.
- external executable scripts default to denied during import and review.
- no role can review its own implementation or grant itself a verdict.
- no model name is part of a role's semantic identity; models are replaceable deployment configuration.
- no automatic publishing from developer Skills into product organization catalogs.

Research pins and the current audit baseline are recorded in the parent epic. Write all findings to the issue and reviewed repository design artifacts; do not modify feature status or human signoff.

Start with parent #438 and its recorded research pins and audit baseline. Inspect the 18 current Skills, 8 generated subagents, live Directory roles, and reusable work from #436, then record the five-subsystem audit, architecture decisions, adoption matrix, supply-chain flow, and dependency-ordered child issues in reviewed repository design artifacts.

Written by the indexing model from the issue text.