feat(apex): add role-separated orchestration foundation

[kratosboom]

ApexCode orchestrator foundation

STACKED ON PR #1

Implemented:

• typed agent roles and explicit capabilities
• fail-closed workflow stages and terminal states
• audited actor/role/task-revision/source-revision actions
• separation of duties for implementation, security, DevOps, and release authority
• evidence, task-state, and policy-aware release decisions
• GPRO elite SHA A/SHA B stale-evidence fixture

Verification:

• cargo test --manifest-path apexcode/Cargo.toml --workspace — 47 tests passed: foundation 29, orchestrator 18.
• cargo clippy --manifest-path apexcode/Cargo.toml --workspace --all-targets -- -D warnings — PASS.
• git diff --check — PASS.
• cargo fmt --manifest-path apexcode/Cargo.toml --all -- --check — PASS after the foundation formatting-only closure commit.

NO CODEX RUNTIME INTEGRATION
NO PRODUCTION CHANGE
NO MERGE