[Feature] Neutral workflow, Work Authority and claim journal (PR-2) #163

Problem

The workflow policy, the distributed AGENTS.md, and the claim procedure are
GitHub-specific. Multi-Forge requires provider-neutral Work Authority terminology,
a pure local resolution helper, canonical claim identities, and a durable
ClaimAttempt journal with explicit, fail-closed outcomes — with no remote work API
clients anywhere.

Source: Multi-Forge v1.3.2-final §45–54 (PR-2, PR-2A/2B/2C/2D).

Expected outcome

Distributed policy speaks generic "Work Authority"; ainative/forge.py resolves
the observed work authority purely and locally; claims use canonical identities
and a journal written durably before the remote POST; recovery is explicit.

Acceptance criteria

• Blocked until PR-1 green AND ADR-MF-02 accepted.
• PR-2A — Policy neutralization: docs/FORGE-WORKFLOW.md added;
  docs/GITHUB-WORKFLOW.md refactored onto it; docs/GITLAB-WORKFLOW.md
  added; distributed templates/AGENTS.md uses generic Work Authority
  terminology. The repository's own root AGENTS.md may remain
  GitHub-specific.
• PR-2B — ainative/forge.py pure function
  resolve_observed_work_authority(...): no network, no credential lookup,
  no writes, no Multi-Vault push authorization, no provider API calls.
  Priority: explicit WorkItem/ChangeRequest repo → explicit harness authority
  → exactly one compatible observed candidate; otherwise
  WORK_AUTHORITY_UNAVAILABLE / WORK_AUTHORITY_AMBIGUOUS /
  WORK_AUTHORITY_MISMATCH.
• PR-2C — Claim grammar: principal
  <provider>:principal:<stable-provider-id>; event
  <provider>:<event-kind>:<stable-event-id>; V1 kinds comment, note,
  assignment; timestamps normalized UTC; winner ordering
  (created_at_utc, canonical_event_identifier).
• PR-2D — ClaimAttempt journal at .ai-native/state/claim-attempts/
  (existing managed ignore rule covers it): local, durable,
  non-authoritative, non-Verified.
• Claim mutation algorithm implemented exactly: READ WorkItem → READ linked
  active ChangeRequests → GENERATE attempt_id → WRITE PENDING attempt
  atomically → on local write failure CLAIM_JOURNAL_UNAVAILABLE + STOP →
  POST exactly one claim → READ remote again → SEARCH exact attempt marker →
  ARBITRATE → persist outcome.
• Outcomes CONFIRMED, LOST, CONFLICT, UNCERTAIN, ABANDONED;
  never automatically retry an uncertain POST.
• Recovery CLI: ainative claim-attempt list, inspect <id>,
  abandon <id> --confirm (local transition only, no remote mutation, record
  retained; a new attempt is permitted after explicit abandonment).
• Lifecycle invariant test: pending ClaimAttempt files stay byte-identical
  across a normal lifecycle update.
• No remote work API clients, no leases/heartbeats/age-based expiry.

Out of scope

• Provider API clients (GitHub/GitLab WorkItem clients), cross-forge backlog
  federation, automatic backlog migration, claim leases.
• Issue [Feature] Add a designed stale-claim expiration for multi-agent issue claims #33 (stale claim lifecycle) and [MV-19] Managed Git guard hook file and authenticated local IPC #120 (universal Git push mediation)
  remain independent.

Context

• docs/GITHUB-WORKFLOW.md; skills/issue-to-implementation/.
• skills/issue-to-implementation/bin/claim_resolution.py (current logic).
• Depends on PR-1 + ADR-MF-02.

Dependencies

• Blocked by PR-1 ([Feature] Profiles / Features / State V2 (PR-1) #162) and ADR-MF-02 ([Docs] ADR-MF-02 — Neutral Workflow / Claims (design gate for PR-2) #159).