refactor: extract shared utilities from duplicated patterns

[devin-ai-integration]

Summary

The non-adoption boundary rules, adoption requirements, and protocol metadata were duplicated across README.md, spec/non_adoption_boundary.md, ontology/graphite.yaml, protocol/envelope.schema.json, and spec/graphite.protocol.md — with content drift already present (e.g. README used "use" where YAML says "invoke").

New lib/ modules make ontology/graphite.yaml and envelope.schema.json the single programmatic source of truth:

lib/paths.mjs      — rootDir resolution
lib/meta.mjs       — loadMeta(), getStatus(), getAdoption(), getNonAdoptionBoundary()
                      reads and caches ontology/graphite.yaml via `yaml` package
lib/envelope.mjs   — createEnvelope({ kind, payload, gate }), validateEnvelope(obj)
                      reads protocol/envelope.schema.json; validates required fields, types, patterns
lib/boundary.mjs   — checkBoundary(), isAdopted(), getBoundaryRules()
                      delegates to meta.mjs; returns { enforced, status, rules }
lib/index.mjs      — barrel re-export

scripts/check.mjs now uses the shared lib instead of only checking file existence — it also validates meta loading, boundary rules, and envelope creation/validation.

New scripts/validate-consistency.mjs (npm run validate) detects cross-file drift:

• package.json version ↔ ontology status
• README boundary rules ↔ YAML non_adoption_boundary
• spec/non_adoption_boundary.md ↔ YAML non_adoption_boundary
• spec/adoption_gate.md ↔ YAML adoption.requires_signed_decision
• spec/graphite.protocol.md protocol prefix ↔ envelope.schema.json pattern

Fixed 3 existing drifts found by the validator:

• README: "use" → "invoke" to match YAML
• spec/non_adoption_boundary.md: added the 3 YAML boundary rules that were missing from the "Do not use" block

CI: added npm ci step to workflow since the project now has a runtime dependency (yaml).

Link to Devin session: https://app.devin.ai/sessions/a98b817d59c748e1b0e6949367039970
Requested by: @cemphlvn

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring