feat(roadmap-control-plane): governed EpicDefinition apply and RoadmapProposal integration #68

Parent: #66
Blocked by: #67

Goal

After read-only drift detection is proven, add the governed write path and connect it to the existing roadmap proposal workflow.

Scope

• deterministic apply of parent/sub-issue/dependency/project changes;
• exact EpicDefinition git revision/content hash carried into audit/evidence;
• fail closed on ambiguous or externally changed bindings;
• no LLM in the apply activity;
• add roadmap-decompose output that produces an EpicDefinition draft;
• bind approval to the exact manifest hash;
• publish via PR to mctlhq/.github/roadmap/epics/, not a sequence of generic GitHub mutations;
• keep mctl-api as RoadmapProposal persistence/auth boundary and mctl-agents as deterministic GitHub mutation boundary.

Preconditions

• v1alpha1 schema/semantic validator merged from roadmap(roadmap-control-plane): declarative EpicDefinition and GitHub graph reconciliation #66 first slice;
• read-only reconciler feat(roadmap-control-plane): reconcile EpicDefinition against live GitHub graph #67 proven green on converged state and red on deliberate mutations.

Acceptance criteria

• Apply path mutates only the graph relations/metadata permitted by the reviewed manifest.
• Retry/replay is idempotent.
• Audit identifies actor/proposal/manifest hash and resulting GitHub targets without copying issue bodies.
• LLM output cannot directly choose arbitrary GitHub mutation targets at apply time.
• A RoadmapProposal can end in a reviewable EpicDefinition PR.
• A merged manifest can reconcile Human Input without hand-maintained duplicate graph declarations.

Non-goals

• Automatic merge of the manifest PR.
• Replacing GitHub Issues/Projects UI.
• Migrating every existing epic in the first write-enabled release.