Add lightweight company OS manifest

[WalksWithASwagger]

Summary

• add a lightweight .company-os/project.yaml for WhisperForge/SpektorAI
• record repo identity, local loops, validation commands, and simple KK decision boundaries
• keep authority lightweight for personal/vibe-code work: agents can edit/test/branch/PR; KK decides merges, live publishing, paid-provider changes, real secret rotation, deletion, and public/external messages

Verification

• python3 -c YAML parse passed from the portfolio sweep workspace

No deploys, production writes, branch deletions, or external messages.