feat: operational tooling — signing, versioning, changelog, roadmap (SPEC-001)

Establish GuruConnect's release engineering and project tracking (SPEC-001):
- docs/ scaffold: FEATURE_ROADMAP, ARCHITECTURE_DECISIONS (ADR-001 standalone+contract,
  ADR-002 Gitea Actions + Azure Trusted Signing), docs/specs/SPEC-001, CHANGELOG.
- .gitea/workflows/release.yml: conventional-commit auto-versioning, git-cliff changelog,
  Windows agent build, Azure Trusted Signing via jsign (reusing the shared ACG cert profile),
  Gitea release via REST API. build-and-test.yml is the PR/push gate; deploy.yml de-duplicated.
- server: GET /api/changelog/:component/:version (latest + by-version), path-traversal hardened.
- cliff.toml; server/.env.example documents CHANGELOG_DIR.

Reviewed (Code Review Agent): axum route-conflict blocker fixed; CHANGELOG ordering, toolchain
target, breaking-change parsing, empty-changelog fallback addressed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-and-test.yml

@@ -1,5 +1,10 @@
 name: Build and Test
 
+# PR/push CI gate (SPEC-001): fmt, clippy -D warnings, build, test, cargo-audit.
+# This workflow does NOT version, sign, or release — that is release.yml's job. The agent build
+# here is a compile gate only (it produces an unsigned artifact for inspection). Release commits
+# carry `[skip ci]` so this workflow does not re-run on the version-bump commit.
+
 on:
   push:
     branches:
@@ -77,7 +82,8 @@ jobs:
         uses: actions-rs/toolchain@v1
         with:
           toolchain: stable
-          target: x86_64-pc-windows-msvc
+          # Single source of truth for the Windows target used by the build below.
+          target: x86_64-pc-windows-gnu
           override: true
 
       - name: Install cross-compilation tools
@@ -100,7 +106,7 @@ jobs:
 
       - name: Build agent (cross-compile for Windows)
         run: |
-          rustup target add x86_64-pc-windows-gnu
+          # Target is installed by the toolchain step above (single source of truth).
           cd agent
           cargo build --release --target x86_64-pc-windows-gnu