Zero-to-Receipt showcase, planning-state hygiene, and Windows fork fixes (#268)

[SethGammon]

What

Cherry-picked onto current main and integrated with v1.3.5:

1. Showcase + hygiene — docs/SHOWCASE.md, the canonical Zero-to-Receipt Operation Fork journey, written against the exact shipped CLI contract (fork start|status|resume|compare|select|land plan|land apply|receipt verify --input|replay --output); docs/archive/; internal .planning/ state local-only; packaging aligned with the governed release policy.
2. Windows fork fixes (refs Operation Fork on Windows: read-only branches, .cmd verifier ENOENT, and no-op landings #268) —
   • -c windows.sandbox=elevated injected on win32 so forked Codex branches regain workspace-write;
   • workflow verifiers resolve through platformInvocation so .cmd shims (npm) spawn shell-free;
   • FORK_LANDING_EMPTY blocks landings whose selected branch tip equals the base revision.

Review blockers addressed

• Fixture: the Windows npm-shim case now injects both resolveEntrypoint and nodePath, making it deterministic on every CI OS (same pattern as the existing codex shim fixture).
• Showcase rewrite: every command matches citadel fork --help exactly, including normalized fork ids, two-profile executor requirement, single-line objective title, revision-bound selection, clean-target landing tokens, and offline receipt verification flags. The interruption section states the real contract: interrupted branches are permanently blocked (RUNTIME_EFFECT_AMBIGUOUS) and recovery is a new fork — resume is containment, not continuation. The agent-commit boundary and FORK_LANDING_EMPTY are documented as a current limitation with the design question linked.
• Recovery claim: no doc claims mid-flight continuation anymore.

Verification (rerun on this branch)

• Full required suite: All tests pass (includes package-bloat policy, public install path, Operation Fork execution/executors/security, release integrity).
• Golden-path fixture matrix, win32 leg, 5 repetitions × both runtimes: 10/10 passed — install/setup 100%, verified handoff 100%, resume resolution 100%, exact rollback 100%; median install→route 2496.5 ms; p90 install→verified-handoff 5654 ms. The complete_grid gate remains honestly open pending the linux/darwin legs produced by this PR's CI matrix.
• Live evidence for Operation Fork on Windows: read-only branches, .cmd verifier ENOENT, and no-op landings #268 fixes: dual-model fork run in https://github.com/SethGammon/citadel-fork-demo (docs/FINDINGS-run-2026-08-22.md) — first comparable run ended in a preserved tie with offline-verified receipts.

Remaining (tracked in #268)

Commit-in-isolation design so agent work can actually land: Citadel-managed post-run commit step or worktree-local git metadata.