fix(audit): post-v0.12 audit remediation — checkpoint typo + report template + ARCHITECTURE drift

---ci---
project: orca
phase: 28
milestone: v0.12
status: complete
---

Post-milestone audit (v0.11.28 milestone release) found 3 issues; this
commit remediates all three and tags the result v0.11.29 per the
feature-milestone progressive-patch rule (v0.11.x patch line; no
separate v0.12.0 tag per ROADMAP).

1. CHECKPOINT.json typo: key "phases_shiped" -> "phases_shipped"
   (missing 'p' made the 29-phase shipped list unreachable). All 29
   phases P0..P28 now readable by canonical key.

2. Missing audit artifact: opencode/ci/references/report-template.md
   created. Binding template covering all 5 audit steps + verdict
   convention (PASS/WARN/FAIL). Satisfies audit Step 5 check #4
   (report-template exists).

3. ARCHITECTURE.md drift: removed stale internal/orch/ reference
   (package never existed; replaced by internal/sshpush/ in v0.9).
   Appended "v0.9-v0.12 Component Addendum" documenting all 25 packages
   introduced across v0.9-v0.12 (workload/runtime, state/persistence,
   transport/bootstrap, security/identity layers). ARCHITECTURE.md now
   matches actual code structure.

Re-audit PASS: all 6 audit checks green; project state fully
reconstructable from git log.

opencode/ci/references/report-template.md

@@ -0,0 +1,78 @@
+# Phase Audit Report Template
+
+Use this template for CIAgent audit reports (`ciagent-audit` workflow).
+Fill each section; mark N/A where a check does not apply (e.g. no active
+phase branch after milestone completion). Keep verdicts binding: PASS /
+FAIL / WARN only — no soft language.
+
+---
+
+# Phase Audit — <milestone> (<milestone summary>)
+
+**Project**: <slug>
+**Milestone**: <version> — <summary>
+**Date**: <YYYY-MM-DD>
+**Branch**: `<current branch>`
+**Result**: <PASS / WARN / FAIL> — <one-line summary>
+
+## Step 1 — Reconstruction Test
+
+- Latest `---ci---` block (HEAD): `project: <slug>, phase: <N>, milestone: <ver>, status: <stage>` — <matches / mismatches> CHECKPOINT.json (`phase: <N>, stage: <stage>`).
+- config.json `milestone: <ver>` — <matches / mismatches>.
+- `make verify-reqs` → <result line> — ROADMAP ↔ REQUIREMENTS <consistent / inconsistent>.
+- <N>/<M> commits have `---ci---` blocks (<%> commit discipline).
+
+## Step 2 — .ciagent/ File Discipline
+
+- `config.json`: <valid / invalid> JSON, required fields <present / missing>: <list gaps>.
+- `PROJECT.md`: required sections <present / missing>: <What This Is / Requirements / Constraints / Key Decisions>.
+- `ROADMAP.md`: phases <match / mismatch> git branches; <merged=complete, active=in-progress>.
+- `REQUIREMENTS.md`: traceability matrix <complete / incomplete>; <N> REQ references.
+- `ARCHITECTURE.md`: components <match / mismatch> actual code structure; <list stale refs>.
+- `PERSONAS.md`: roster <current / stale>.
+
+## Step 3 — Branch Hygiene
+
+- Phase branches: <N> active, <N> merged, <N> orphan.
+- Milestone branches: <N> active, <N> merged.
+- Orphan branches (no `---ci---` commits): <list or "none">.
+- Stale merged branches (should be deleted): <list or "none">.
+
+## Step 4 — Commit Discipline
+
+- Total commits: <N>; with `---ci---`: <N>; without: <N> (<pre-convention legacy, acceptable / unexpected — investigate>).
+- Stale decisions (D-series in `.ciagent/` >50 commits old, not reflected in code): <list or "none">.
+- Unresolved escalations older than timeout: <list or "none">.
+
+## Step 5 — Audit Checks
+
+1. HEAD not on main when phase/milestone branches exist — <PASS / N/A / FAIL>: <detail>.
+2. CHECKPOINT.json exists — <PASS / FAIL>.
+3. CHECKPOINT.json consistent with git status — <PASS / FAIL>: <detail>.
+4. Report template exists (`opencode/ci/references/report-template.md`) — <PASS / FAIL>.
+5. No pending escalations — <PASS / FAIL>: <detail; auto-resolved is OK>.
+6. Milestone version in config consistent — <PASS / FAIL>: config=<ver> vs ROADMAP=<ver> vs checkpoint=<ver>.
+
+## Issues
+
+List each issue with severity (P0 blocking / P1 fix-soon / P2 nice-to-have):
+
+- [P0] <issue> — <impact> — <fix>.
+- [P1] <issue> — <impact> — <fix>.
+- [P2] <issue> — <impact> — <fix>.
+
+If no issues: "All checks passed. Project state is fully reconstructable from git log."
+
+## Recommendations
+
+1. <action>
+2. <action>
+3. <action>
+
+---
+
+## Verdict Convention
+
+- **PASS** — all checks green; no P0/P1 issues. Ship proceeds.
+- **WARN** — no P0; one or more P1/P2. Ship proceeds; issues logged for follow-up.
+- **FAIL** — any P0 issue. Ship blocked; resolve and re-audit.