feat(roadmap): expose governed roadmap maintenance operations over EpicDefinition and Project metadata #329

Context

Follow-up to:

• roadmap(roadmap-control-plane): declarative EpicDefinition and GitHub graph reconciliation .github#66 — Roadmap Control Plane
• feat(roadmap-control-plane): governed EpicDefinition apply and RoadmapProposal integration .github#68 — governed EpicDefinition apply
• feat(roadmap): governed propose/approve/publish MCP workflow #252 — governed roadmap propose/approve/publish workflow

The goal is to expose narrow semantic roadmap-maintenance operations through mctl-api without giving MCP callers arbitrary GitHub mutation capability.

Proposed operations

• mctl_roadmap_create_work_item
• mctl_roadmap_update_work_item
• mctl_roadmap_close_work_item
• mctl_roadmap_reparent_work_item
• mctl_roadmap_set_priority

Guardrails

• authenticated actor derived server-side;
• canonical target resolution server-side;
• no caller-controlled repo/project/field/raw REST/GraphQL parameters;
• graph mutations flow through reviewed RoadmapProposal / EpicDefinition changes;
• apply is bound to the exact approved manifest revision/content hash;
• graph mutation stays blocked until read-only reconciliation from .github#67 is proven;
• set_priority mutates only the configured Org Project priority field (P0/P1/P2/PARK), not EpicDefinition;
• compare-and-set / concurrency protection and idempotent retry;
• full audit trail for actor, semantic operation, canonical refs and before/after state.

Acceptance criteria

1. Semantic MCP/API contracts are documented and policy-enforced.
2. Priority update works through a fixed server-side Project mapping.
3. Create/update/close/reparent produce or reuse governed roadmap proposals rather than raw GitHub writes.
4. Exact-hash approval and deterministic apply integrate with ci: add TOKEN_2 fallback for quota resilience #68.
5. Replays are idempotent and concurrent/stale writes fail closed.
6. Tests cover authorization, graph safety, cycles, stale hashes and Project priority conflicts.