Add runtime orchestration stack contract and preflight smoke (DAS-2650)

[Fearvox]

Summary

• add docs/runtime-orchestration-stack.md
• add issue-templates/runtime-stack-preflight.md
• add scripts/check-runtime-stack-preflight.mjs
• wire the runtime-stack contract into AGENTS.md and SYNTHESIS.md

Source

• Issue: DAS-2650
• Lane: Workbench Admin control-plane / runtime-stack preflight contract

Verification

• git diff --check main...HEAD
• bun scripts/check-runtime-stack-preflight.mjs

Scope

Docs/template/script only. No provider config, no runtime mutation, no daemon/Desktop/core changes.

[Fearvox]

Capy /capy: Please run a bounded review on the current HEAD for this PR only. Findings first. Focus on role-split clarity, runtime-stack authority order, preflight contract completeness, and any anti-LGTM reason this should stay FLAG instead of moving forward.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Fearvox]

Codex verification before merge:

• git diff --check main...HEAD PASS
• bun scripts/check-runtime-stack-preflight.mjs PASS
• branch is pushed and PR is open: codex/runtime-orchestration-stack -> PR Add runtime orchestration stack contract and preflight smoke (DAS-2650) #41
• scope check PASS: docs/template/script only (docs/runtime-orchestration-stack.md, issue-templates/runtime-stack-preflight.md, scripts/check-runtime-stack-preflight.mjs), no provider config or live runtime mutation

Verdict: PASS for source review surface. External anti-LGTM remains pending; no merge claim.

[Fearvox]

Addressed the validation findings on current HEAD 831cbf9.

Fixed:

• provider-key detection now catches sk-..., sk-proj-..., sk-ant-..., while preserving the existing underscore synthetic form
• IPv4 detection now validates octets and excludes private/non-public ranges, so invalid examples like 223.999.999.999 no longer false-positive
• WorkBench -> Workbench in the runtime-stack preflight template intro

Validation:

• git diff --check main...HEAD PASS
• /opt/homebrew/bin/node scripts/check-runtime-stack-preflight.mjs PASS
• bun scripts/check-runtime-stack-preflight.mjs PASS
• link-targets-ok
• regex harness: sk-, sk-proj-, sk-ant-, and sk_ all match; 223.999.999.999 = false; 192.168.1.10 = false; 223.12.34.56 = true

No scope change beyond scripts/check-runtime-stack-preflight.mjs and issue-templates/runtime-stack-preflight.md.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.