fix: correct overstated README scope, add AI-DLC scaffold, dedupe analyze-path wiring

[derek-palmer]

Summary

Verify-and-fix pass over TechDebtter: confirm the product does what its docs claim, correct documentation that overstated the code, and fix small contained defects. No new product capability.

• README.md: opening description claimed continuous detection across eight technical-debt categories; only vulnerability scanning (Trivy + KEV/EPSS) is implemented. Rewrites the description to state that scope plainly, moves the eight-category language to a Roadmap section, and documents the previously-undocumented observe/verify CLI subcommands in Usage.
• SPEC.md / docs/architecture.md: adds the missing FindingVerificationGateway port to both port lists (six documented, seven actually exist). SPEC.md C10 claims live external smoke tests run on a schedule; confirmed that half is unimplemented — no committed workflow file has an on: schedule trigger, and a repo admin checked the repo's Settings → Actions → Scheduled workflows page and found none registered there either. C10's other half (deterministic tests/checks block main) is unaffected and remains satisfied via ci.yml.
• src/wiring/dependency-wiring.ts (new): extracts the CLI/Action analyze-path dependency wiring that was genuinely duplicated between src/cli/bootstrap.ts and src/action/main.ts. Preserves both entry points' existing behavioral divergences unchanged — CLI's hardcoded organization-policy stub vs. Action's live GitHub read, and differing cache-root paths — surfaced and corrected across three rounds of adversarial design review before implementation.
• 6 new tests: verify existing security invariants that were previously untested — no working-tree mutation during analyze, dirty-worktree rejection, policy-resolution authority chain, write-token isolation in the new wiring, and GitHub Actions SHA-pinning.
• .claude/ + aidlc/: adds the AI-DLC orchestrator scaffold and this intent's full workflow record (questions, decisions, reviews, design artifacts) as a separate commit ahead of the product fix.

152/152 tests passing (22 new), typecheck and lint clean, no dependency or public-contract change.

Test plan

• npm run build — all 3 tsup targets succeed
• npx vitest run — 152/152 passing
• npx tsc --noEmit — clean
• npx eslint src test — clean
• Human: checked repo Settings → Actions → Scheduled workflows — none registered, confirming SPEC.md C10's scheduled smoke-test workflow does not exist anywhere (repo or GitHub Settings)

[derek-palmer]

There's no scheduled trigger/action created. Revisiting AIDLC and will update PR.