feat: establish workspace resolution boundary

[chasechou007]

Summary

• add one shared Workspace Resolver for validation, grounding, Candidate, ID, index, and init workflows
• make opendomain/ canonical, retain warned domain/ fallback through 0.x, and never merge dual roots
• bound implicit discovery to semantic directories while preserving explicit file/directory targets
• move the self-model and ERP example to the canonical layout and update user documentation

Compatibility

• legacy-only workspaces remain readable and keep .opendomain/index.json
• canonical indexes default to opendomain/generated/index.json
• opendomain init refuses to shadow a legacy-only workspace
• no automatic migration command is introduced
• no accepted OpenDomain knowledge or Candidate review state is changed

Validation

• Node.js 20: 78 tests passed
• canonical self-model: 24 documents passed
• explicit ERP corpus: 7 documents passed
• npm audit --omit=dev: 0 vulnerabilities
• package dry-run: 46 entries
• installed-tarball smoke: init, validation, ERP validation, and prepare passed
• OpenSpec validation: 6/6 active changes/specs passed