feat: prototype autonomous coding workflow

[geier]

Summary

• document the proposed autonomous issue-to-PR architecture and repository ownership boundaries
• add a safe-by-default TypeScript ADK prototype with plan, execute, and publish modes
• use GitHub issues, branches, comments, and pull requests as durable publish state, with Argo synchronization proposed for production concurrency
• isolate OpenCode from GitHub credentials and shell/network tools while keeping validation and publishing deterministic
• package a pinned plan-worker image and deploy a least-privilege gVisor Argo WorkflowTemplate
• add duplicate PR prevention, command timeouts, and tests for the workflow safety boundaries

Deployment

• cluster: solid-crocodile
• namespace: experiments
• template: adk-coding-workflow-plan
• image: europe-west3-docker.pkg.dev/prokube-internal/prokube-customer/adk-coding-workflow:prototype-cg-20260804-161155
• smoke workflow: adk-coding-workflow-smoke-xnh9r (Succeeded)

Testing

• bun test (28 tests)
• bun run typecheck
• bun audit (no vulnerabilities)
• linux/amd64 image build and private registry push
• server-side Kubernetes manifest validation
• read-only gVisor plan smoke test against prokube/pkui#3531
• git diff --check