feat(docs): complete P2.6 type safety cleanup and P2.7 system invariants

P2.6: Type Safety Cleanup
- Replaced 'any' return types in vite-plugin.ts with concrete types (UserConfig, transform return type)
- Documented TypeScript mixin 'any[]' exception in PlatformServiceMixin.ts
- Audit confirmed: zero 'any' in codebase except documented TS mixin limitation
- All external boundaries use 'unknown', all data payloads use 'Record<string, unknown>'

P2.7: System Invariants Documentation
- Created SYSTEM_INVARIANTS.md documenting all 6 enforced invariants
- Added to docs/00-INDEX.md under Policy & Contracts section
- Each invariant includes: What, Why, How, Where

Progress Docs Updates:
- Updated 00-STATUS.md: marked P2.6/P2.7 complete, added type safety invariant note
- Updated 01-CHANGELOG-WORK.md: added 2025-12-22 entries for P2.6/P2.7
- Updated 03-TEST-RUNS.md: added P2.6 type safety audit test run
- Updated P2-DESIGN.md: marked P2.6 acceptance criteria complete
- Updated SYSTEM_INVARIANTS.md: added Type Safety Notes section

Baseline Tag:
- Created v1.0.11-p0-p1.4-p1.5-p2.6-p2.7-complete

TypeScript compilation: ✅ PASSES
Build: ✅ PASSES
CI: ✅ All checks pass

docs/_reference/github-actions-ci.yml

@@ -0,0 +1,53 @@
+# REFERENCE ONLY — not used in this repo
+#
+# This file is kept as a reference template for GitHub Actions CI.
+# This repo uses local CI via `./ci/run.sh` (which wraps `./scripts/verify.sh`).
+#
+# If you want to use GitHub Actions instead:
+# 1. Copy this file to `.github/workflows/ci.yml`
+# 2. Ensure it calls `./ci/run.sh` or `./scripts/verify.sh`
+# 3. Update progress docs to reflect GitHub Actions usage
+#
+# ---
+
+name: CI
+
+on:
+  push:
+    branches: [ main, develop ]
+  pull_request:
+    branches: [ main, develop ]
+
+jobs:
+  verify:
+    name: Verify Project
+    runs-on: ubuntu-latest
+    
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+        
+      - name: Setup Java (for Android builds)
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+        
+      - name: Run verification
+        run: ./scripts/verify.sh
+        
+      - name: Upload verification logs
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: verification-logs
+          path: |
+            **/*.log
+            **/build/reports/**
+          retention-days: 7