Add façade docs, A2A skeleton, tests, and CI scaffold

[mdheller]

Summary

• add real façade documentation for bootstrap delegation and the hybrid CLI model
• add a compileable Cobra scaffold with root, bootstrap, and workflow commands
• add a simple legacy-derived workflow model under internal/a2a
• add tests and a GitHub Actions Go CI workflow
• keep bootstrap business logic out of this repository

Why

The repository needed to move beyond a handoff dossier and become a real code-bearing façade. PR #1 preserved the unpublished v2.3 CLI as reference lineage, and this PR turns that lineage into a modern scaffold without promoting the old trust/protocol internals.

Included

• go.mod
• CONTRIBUTING.md
• SECURITY.md
• .gitignore
• cmd/prophet/main.go
• internal/cmd/root.go
• internal/cmd/bootstrap.go
• internal/cmd/workflow.go
• internal/a2a/workflow.go
• internal/cmd/root_test.go
• internal/a2a/workflow_test.go
• docs/BOOTSTRAP_DELEGATION.md
• docs/CLI_SURFACE_POLICY.md
• docs/AGENT_HYBRID_MODEL.md
• docs/COMMANDS.md
• .github/workflows/ci.yml

Explicit boundaries

• this repo remains façade-only
• bootstrap implementation still belongs in sourceos-sdk/cmd/sourceos-bootstrap
• no BootReleaseSet / ConfigSource / TokenDoor ownership is introduced here
• no boot/auth/enrollment semantics are invented here

Relationship to legacy work

Use PR #1 as the legacy canopy/reference input. The new workflow/A2A scaffold deliberately keeps the old phase structure while replacing the old transport and key-management assumptions.