feat: content model, state machine, admin UI, and test infrastructure

[flyingrobots]

Summary

• Content Identity Policy (M1.1): Canonical slug validation — NFKC normalization, reserved words, regex enforcement, CmsValidationError contract
• State Machine (M1.2): Explicit draft/published/unpublished/reverted states with enforced transition rules and idempotent publish
• Admin UI overhaul: Split/edit/preview markdown editor, autosave, toast notifications, skeleton loading, drag-and-drop uploads, metadata trailer editor, keyboard shortcuts, dark mode
• DI seam + InMemoryGraphAdapter: CmsService accepts an injected graph for zero-subprocess unit tests (~11ms vs hundreds of ms)
• Infrastructure: @git-stunts/alfred and docker-guard deps, dependency integrity checks, ROADMAP, CHANGELOG, formal LaTeX ADR, onboarding scripts

Test plan

• npm run test:local — 30 tests pass (3 suites: git, server, chunks)
• npm run test:git-e2e — 2 real-git smoke tests pass
• No production behavior changes — DI seam is opt-in, production path unchanged