Dogfood GroundAtlas in Cat CI

[shtse8]

Summary

• Add project.manifest.json as Cat's vendor-neutral GroundAtlas control file while keeping .doctrine/project.json as the Sylphx Doctrine adapter/governance catalog.
• Add a project-control ADR, spec, SECURITY.md, and Node boundary test.
• Dogfood the published GroundAtlas package/action in CI using groundatlas@0.1.2 / SylphxAI/groundatlas@v0.1.2 with strict fleet assertions and artifact upload.
• Add caller-side id-token: write to the Release workflow so the shared release workflow can use trusted publish identity/provenance.

Boundary

This is a project-control/release-readiness slice. It does not change Cat runtime package behavior and does not publish any @sylphx/cat* package. Package publication still requires Changesets release intent, the shared Release workflow, and npm registry readback for affected packages.

This PR supersedes the stale/conflicting project-manifest PR #8 with a current main-based GroundAtlas gate.

Validation

Local validation run from /tmp/groundatlas-rollout/cat:

• bun install --frozen-lockfile
• git diff --check
• node --test test/project-control.node-test.mjs
• npm exec --yes --package groundatlas@0.1.2 -- ga update --out .groundatlas-pilot
• npm exec --yes --package groundatlas@0.1.2 -- ga audit --out .groundatlas-pilot
• npm exec --yes --package groundatlas@0.1.2 -- ga fleet . --out .groundatlas-pilot --require-atlas --strict --json → { "adopted": 1, "warning": 0, "blocked": 0, "total": 1 }
• YAML parse for .github/workflows/ci.yml and .github/workflows/release.yml
• CI runtime-change classifier simulated from staged files → runtime=false
• Extra confidence: bun run build passed

Known baseline not introduced by this PR:

• bun run check currently fails on pre-existing packages/cat-redaction/src/redaction.ts Biome regex-literal warnings.
• bun run test currently fails because @sylphx/cat has no files matching its configured tests/**/*.test.ts pattern. This PR intentionally avoids runtime package changes, and CI keeps runtime checks scoped to runtime-affecting diffs.