Update README.md - #1

…contract hard gate (#69)

Documentation and CI debt cleanup after the Hugo migration (no runtime change
to the shipped site except a stricter publishing contract).

Content Contract (P0 #1/#3):
- scripts/ci-content-contract.cjs: split into ADDED (hard gate, exit 1 on
  invalid new post) vs MODIFIED (report-only) tiers. New publications in
  content/blog/ MUST satisfy schema/post-metadata.schema.json.
- .github/workflows/hugo.yml: drop `|| true` — an invalid new post now blocks
  the Hugo build/deploy (it was only a warning before).

CI/CD consolidation (P0 #2):
- .github/workflows/deploy-ipfs.yml: DISABLED (legacy Jekyll build + compromised
  Pinata credentials; tag pre-phase7-legacy keeps the Jekyll state).
- .github/workflows/security.yml: drop Ruby/Jekyll steps (broken post-Phase-7),
  pin aquasecurity/trivy-action@v0 (was @master).
- Fix stale `master` branch refs -> `main` in analytics.yml, security.yml,
  sync_gists.yml.

Docs:
- AGENTS.md rewritten for the Hugo + Blowfish reality (was describing Jekyll).
- README.md: tests badge, hard-gate wording, explicit CI/CD workflow table
  (single publisher = hugo.yml), link to the new ADR.
- docs/adr/0002-two-plane-architecture.md: formal Publishing vs Engineering
  plane boundary, integration points, DAO lifecycle (separate track).

Local: hugo build 155 HTML, validate-frontmatter exits 1 on invalid / 0 on
valid, ci-content-contract vacuous on no-new-posts, hard gate wired.

Co-authored-by: dominicusin <dominicusin@users.noreply.github.com>