refactor(doctrine): compress kernel + CI node bump + banner refresh

[mbanderas]

Post-1.7.0 cleanup. Three concerns:

• ci: setup-node v4 -> v5, node-version 20 -> 24 (Node 20 runtime deprecation on GitHub runners).
• refactor(doctrine): compress always-on kernel (AGENTS.md) 11,582 -> 10,296 B (-11%). Every S0-S10 rule and hard invariant kept verbatim (verdict-line format, 4 status tokens, S8 NEVER-alter list, model tiers, toolBudget); 34/34 anchors verified. Headroom under the Windsurf/Codex 12K char limit: ~488 -> ~2,000 chars for user repo content.
• docs: README banner refreshed (13 -> 17 tasks, 123 -> 147 valid A/B runs, ~11 -> ~10 KB kernel).

Out of band (not in this PR): global ~/.claude/AGENTS.md updated to match; 25 downstream repos re-synced via scripts/sync-maestro.ps1 (uncommitted, per-repo review); govyn-cloud/CLAUDE.md got its missing @AGENTS.md import.

Tests: npm test green.