Adopt the portable AI-native SDLC north star and roadmap

[yihanzhu]

Goal

Adopt the operator-approved north star: ystack is a harness-, model-, forge-, and
CI-neutral control plane for the complete AI-native SDLC loop. Claude, Codex, and
GitHub remain the first preference profile, not product requirements.

Why

The AI-Native SDLC Playbook review found that ystack's artifact chain and human
gates are strong, but the current roadmap automates writes before credential
separation, evals, reconciliation, and risk-tiered plan approval. Draft PR #146
also hardcodes one harness and forge. The durable direction needs to land before
implementation resumes.

Acceptance

• NORTH_STAR.md has one active, operator-approved portable north star and keeps
  the prior goal in history.
• ROADMAP.md records portable interfaces, canonical state, security boundaries,
  risk-tiered plan acceptance, evals/metrics, self-hosting versus external-target
  proof, and dependency-ordered rollout.
• AGENTS.md, REVIEW.md, README.md, and work/README.md do not contradict
  the roadmap.
• ROADMAP.md is restore-critical and protected from unattended edits.
• PR impl: v2-phase-2 (b — lane) #146 remains a draft experiment and is not resumed as the implementation.

Files

• NORTH_STAR.md
• ROADMAP.md
• AGENTS.md
• REVIEW.md
• README.md
• work/README.md
• ci/required-files.txt

Out of scope

• adapter implementation;
• changes to the live Claude/Codex/GitHub default profile;
• autonomous write enablement;
• the next portable-control-plane-core intent, which gets its own G1 PR after
  this direction is merged.