Add audited self-hosted platform and retain Local workflows

[Robert0622]

Summary

The public default branch currently ships local agent workflows. This PR adds the self-hosted LoopForge platform at the repository root and preserves the existing workflows, installers and npm package under local/, with guides under docs/local/.

The platform includes workflow execution, runners, approvals, artifacts, shared task groups, durable group-to-SOP handoff, workspace tools and archived previews. Public adapters provide password accounts, explicit administrator grants, actor-scoped model credentials and GitHub Issue/PR integration. The container installer, public starter catalog, bilingual onboarding and no-key script/approval demo support fresh installations without enterprise services.

Publication scope

• Audited source export from master 3a8cb2420904e3ee8ab1b39c48f54b372a9e3e04: 1,718 source blobs verified; 1,461 unchanged, 183 adapted and 74 excluded, plus 62 audited public additions in the platform export scope. Private history, deployment configuration, employee defaults, credentials and acceptance reports are excluded.
• Root MIT licensing is retained, together with original editor notices and a complete notice bundle for 86 Go modules. Provider CLI packages retain their own terms and notices.
• The default container listener binds to localhost. This release targets trusted teams: authenticated reads span the instance, project writes require permission, and Docker access requires trusted operators. See deployment boundaries.
• Much of the diff comes from embedded Monaco/Code-OSS distributions and moving existing workflows. Source/override manifests record adaptations for future synchronization.

Correctness and CI changes

• Runner cancellation stops listening to the completed context; one goroutine drains output and owns cmd.Wait. Early control failures reap the command before returning. Real-process regressions reproduce the original exit-status loss and pass after the fix, including race-detector coverage.
• The preview cleanup test waits for asynchronous cleanup before closing its store; runtime behavior is unchanged.
• Git staging handles an empty eligible index on Git 2.55 without ignoring staging errors or removing exclusions. Tests cover empty/excluded-only checkouts and ordinary source additions, updates and deletions.
• For non-root native services, default/root Docker images use the service UID/GID to access private workspaces. Explicit non-root image users are retained. Real Docker regression verifies ordinary commands and isolated scripts, host-readable output, workspace mode 0700, zero effective capabilities and no-new-privileges.
• CI uses explicit API test file globs on Node 22, runs the checkout-free E2E gate from an existing directory, and provisions the no-key acceptance account through normal signup with ordinary-user and welcome-membership assertions. Tests and authorization checks remain enabled.

Validation

On commit 69ca0ae, all 13 GitHub Actions checks passed across the platform, validate and E2E workflows, including the required E2E gate.

• Hosted API: 101 passed, 12 skipped, 0 failed, including the real Docker case.
• Broad browser UI: 6 passed, 2 skipped; public browser suite: 20 passed, 6 skipped.
• Fresh-install job: passed, including browser first-account setup and public regression.
• Core: full Go tests, native CLI protocol acceptance, vet, vulnerability scan, dependency notices, source/public-content and secret checks passed.

The independent Tencent CodeCC check is still in progress; it is separate from these completed Actions jobs.

Additional local checks include before/after reproductions on Git 2.55 and as a non-root Docker service user, repeated runner and preview regressions, Node 22 API acceptance, source/public-content checks, Gitleaks, exact local-secret comparisons, dependency notices and installation smoke tests. govulncheck found zero affected vulnerabilities; E2E npm audit reported zero vulnerabilities.

Live-model and empty-install skips are explicit. Paid Codex/Claude, external knowledge/notification services, actual multi-machine pools and every operating system are outside full live verification. Prior live Docker, CodeBuddy and GitHub evidence is documented with its own scope.

Details: verification record, release review, public adaptation scope, upstream synchronization.

Earlier proposals

#46 is closed as superseded by this platform import. #47 is closed at the owner's explicit request: its separate workspace redesign and room-crew proposal are retired, with no port planned. Only its language/theme mechanism is reused; closure does not imply full feature parity.

This PR submits source for review; it does not publish packages, images, tags or a GitHub Release.

Repository-optional SOP fix (82cb7f6)

All four generic SOPs can run without repository binding. Existing configured repository validation remains; repository-scoped custom steps retain their requirements. Product prompts deliver documents; frontend/backend prompts support workspace projects; bug fixes still require real code and reproduction details. Public tool schemas and assistant guidance now describe GitHub correctly. Starter roles explicitly receive user input through taskbooks. Explicit migration 016 preserves operator edits and existing project copies.

Validation: full Go suite and catalog/MCP regressions passed; MySQL repeatability and edit preservation verified. Updated 8096 without resetting accounts, configuration or conversations. Latest-head CI is still pending; prior-head CI results do not establish this head as green.