feat(F-001): scaffold modular monolith skeleton with boundary checker

- TypeScript + Fastify skeleton under project/ (src/modules, shared, infrastructure, app)
- scripts/check-module-boundaries.mjs enforcing module public-API rules (tested with fixtures)
- GET /health endpoint, error envelope without stack leakage
- specs/F-001-scaffold (SPEC/DESIGN/TASKS/TESTS), spec/tech.md dependency justification
- 30-ticket MercadoDeVida roadmap in backlog/features.json, spec/roadmap.md
- All gates approved: reviewer, security, qa; verify.sh green

harness/workflow.stages.yml

@@ -0,0 +1,62 @@
+version: 1
+
+feature_states:
+  allowed: [pending, in_progress, blocked, done]
+
+stages:
+  - name: intake
+    owner: leader
+    input:
+      - backlog/features.json
+      - work/current.md
+    output:
+      - work/current.md
+
+  - name: design
+    owner: architect
+    optional: true
+    output:
+      - work/artifacts/<feature_id>/architect.md
+
+  - name: build
+    owner: implementer
+    output:
+      - work/artifacts/<feature_id>/implementer.md
+
+  - name: review_gate
+    owner: reviewer
+    required: true
+    output:
+      - work/artifacts/<feature_id>/reviewer.json
+
+  - name: security_gate
+    owner: security
+    required: true
+    output:
+      - work/artifacts/<feature_id>/security.json
+
+  - name: qa_gate
+    owner: qa
+    required: true
+    output:
+      - work/artifacts/<feature_id>/qa.json
+
+  - name: document
+    owner: documenter
+    optional: true
+    when: docs/API/contracts/user-facing behavior changed
+    output:
+      - work/artifacts/<feature_id>/documenter.md
+
+  - name: close
+    owner: leader
+    required: true
+    output:
+      - work/artifacts/<feature_id>/leader-close.json
+      - work/history.md
+
+close_requirements:
+  - reviewer.json.verdict == "APPROVED"
+  - security.json.verdict == "APPROVED"
+  - qa.json.verdict == "APPROVED"
+  - scripts/verify.sh exit_code == 0