[codex] Harden governance tooling and policy alignment

[screenleon]

Summary

• Clarify README.md so first-time readers can immediately understand the repository purpose: a portable governance layer for AI coding agents, not an app runtime.
• Align template-mode decision capture guidance with decision_log.policy: example_only across README, project manifest, templates, and skills.
• Add VERSION with 0.20.0 and update CHANGELOG.md with the release notes for this governance hardening work.
• Harden layered-rule governance by enforcing canonical active-rule fields and updating domain rule templates to the canonical contract.
• Fix context-pack decision parsing so commented DECISIONS.md examples are ignored, refresh the deterministic golden output, and align trace/budget tooling with current repo behavior.
• Include VERSION in rule-governance workflow path filters so version-only release metadata changes still trigger governance CI.

Review Follow-up

Critic and architecture review found additional issues after the first pass:

• docs/schemas/trace.schema.yaml had duplicate task_summary keys after adding the Medium/Large requirement; this is now consolidated into one field.
• scripts/lint-layered-rules.sh needed to reject whole-field placeholder values while still allowing legitimate examples containing angle brackets or HTML snippets.
• README still explained mechanics before purpose and retained some fixed-DECISIONS.md wording; it now leads with the project purpose, actual repository contents, and policy-aware decision capture.

Validation

• bash scripts/lint-layered-rules.sh
• bash scripts/lint-doc-consistency.sh
• bash scripts/adoption-audit.sh --template-mode
• python3 scripts/validate-prompt-budget.py --all
• bash scripts/agent-review.sh
• bash scripts/test-tooling.sh
• bash scripts/budget-report.sh
• bash -n scripts/lint-layered-rules.sh
• bash -n scripts/budget-report.sh
• python3 -m py_compile scripts/build-context-pack.py scripts/decisions-conflict-check.py
• git diff --check

Note: adoption-audit.sh --template-mode still emits the expected warning that DECISIONS.md has no real decision entries; that is consistent with the template repo's example-only policy.