feat: align CortexPilot with the L0 command tower contract

[xiaojiou176]

Summary

• align README, docs front door, dashboard copy, and navigation around the L0 AI engineering command tower story
• add machine-readable control-plane runtime policy plus new wave/worker/context/harness schemas
• expose the new control-plane policy in /api/policies and the dashboard Policies page
• derive wave_plan and worker_prompt_contracts into PM Flight Plan preview and surface them in the sidebar
• update orchestrator/dashboard tests to cover the new policy and preview artifacts
• sync upstream inventory with actions/dependency-review-action

Verification

• bash scripts/run_orchestrator_pytest.sh apps/orchestrator/tests/test_schema_validation.py apps/orchestrator/tests/test_intake_preview_helpers.py apps/orchestrator/tests/test_main_helpers_coverage_f1.py apps/orchestrator/tests/test_api_main_coverage_extra.py apps/orchestrator/tests/test_api_main_runtime_views.py -q
• bash scripts/run_workspace_app.sh dashboard test:target -- tests/home_page.test.tsx tests/pm_intake_components_branches.test.tsx tests/command_tower_ui.test.tsx
• bash scripts/run_workspace_app.sh dashboard build
• npm run docs:check
• npm run scan:host-process-risks
• npm run ci
• CORTEXPILOT_HOST_COMPAT=1 bash scripts/test.sh
• pre-commit run --all-files
• npm run truth:triage

Residual limitation

• truth:triage now leaves only one fresh external truth failure: ui-audit-playwright, whose latest receipt shows Docker Desktop is unable to start (HTTP 503) during bash scripts/docker_ci.sh lane ui-audit-smoke.