docs: OPERATIONS.md runbook + governance triage + canonical agent-instructions (audits #24, #27)

- OPERATIONS.md: deploy (Vercel axis project, root frontend/, main auto-deploy),
  migrations (migrate.yml supabase db push, incl. the .gitignore allowlist trap),
  tag-triggered release path, env/secrets layout (names only), local dev,
  incident basics grounded in coordination-client/job-board source
- GOVERNANCE_TODO: corrected premise (2 items, not 26), both verified still
  open via gh (no CLA for eb6aba9, no CLA check on PRs), added missing
  branch-protection-on-main as a third item
- agent-instructions: this copy is now canonical; unique content from the
  other two copies folded in (they become pointer stubs)