[codex] enforce fail-fast status parsing

[proboscis]

Summary

Enforces the inv-fail-fast invariant while preserving legitimate historical issue data.

• Makes run status parsing and proto/API conversions return explicit errors for genuinely unknown values.
• Keeps issue status back-compat: empty/missing -> open, in_progress/blocked -> open, completed -> resolved, canceled -> closed; genuinely unknown non-empty issue statuses still fail.
• Propagates status/proto conversion errors through daemon, CLI, monitor, query, and store call paths.
• Avoids whole-vault aborts for malformed non-issue Markdown by warning and skipping; malformed files declaring type: issue still fail clearly.
• Fixes the monitor run-dashboard issue-status filter so the - sentinel is skipped instead of being parsed and panicking.
• Adds daemon logAndRepanic, semgrep guardrails for swallowed recover() and discarded enum/parser errors, and a make lint fixture gate.
• Adds the review-rubric hard gate in docs and a PR-template checkbox.

Why

The issue inv-fail-fast requires failed operations to surface explicit errors and forbids unknown-accepting enum parse behavior. The first version was too strict for historical issue statuses and missing status frontmatter; this revision keeps legitimate historical data loadable while still rejecting genuinely unknown values.

Validation

• PATH=/home/kento/local/go/bin:$PATH ORCH_SAFE_CLI_TEST=1 go test ./... -> passed
• PATH=$HOME/.local/bin:$PATH make lint -> passed
  • bad semgrep fixture produced 27 expected findings
  • ok semgrep fixture produced 0 findings
  • real architecture lint produced 0 findings
• PATH=/home/kento/local/go/bin:$PATH ORCH_SAFE_CLI_TEST=1 go test ./internal/store/file -run TestListIssuesAcceptsLegacyAndEmptyStatuses -> passed

Issue

Refs inv-fail-fast