feat(workflow-design): SWBOOT ADR, project_type migration, patch deny stub

SWBOOT-10 remains stub-only pending secondary approval.

Co-authored-by: Cursor <cursoragent@cursor.com>

.doc/adr/2026-09-16-software-project-bootstrap-keys.md

@@ -0,0 +1,16 @@
+---
+title: "ADR: software_bootstrap / software_delivery keys"
+status: accepted
+created: 2026-09-16
+---
+
+# ADR: software project bootstrap workflow keys
+
+## Decision
+
+Introduce official workflow keys `software_bootstrap` and `software_delivery` for `non_medical_software` domain. Medical three-workflow catalog remains unchanged. SWBOOT-10 controlled repo patch is stub-only until secondary approval.
+
+## Consequences
+
+- Additive manifests + catalog allowlist
+- No automatic start of delivery after bootstrap

.doc/test-reports/2026-09-16-software-project-bootstrap-test-report.md

@@ -0,0 +1,22 @@
+# 纯软件项目自举 SWBOOT 测试报告
+
+## 一、 测试背景 (Background)
+覆盖 no-go 后启动 SWBOOT-00…09 基线；SWBOOT-10 仅 stub。
+
+## 二、 测试目标 (Test Objectives)
+ADR、schema 字段、patch deny stub。
+
+## 三、 测试方案与环境 (Test Plan & Environment)
+Go unit + goose additive。
+
+## 四、 预期结果 (Expected Results)
+PatchAllowed=false；迁移可 Up。
+
+## 五、 实际测试结果与判定 (Actual Results & Evaluation)
+- Verdict: PASS（基线 stub）
+
+## 六、 自动化测试套件汇总 (Test Suite Execution)
+`go test ./internal/swboot/ -count=1`
+
+## 七、 测试结论与后续优化建议 (Conclusion & Next Steps)
+完整向导/manifest/PI 黄金项目可后续迭代；不自动 delivery。

deploy/postgres/goose/00048_2026-09-16-software-project-type.sql

@@ -0,0 +1,9 @@
+-- +goose Up
+ALTER TABLE projects ADD COLUMN IF NOT EXISTS project_type TEXT NOT NULL DEFAULT 'medical_device';
+ALTER TABLE projects ADD COLUMN IF NOT EXISTS compliance_profile TEXT NOT NULL DEFAULT '';
+ALTER TABLE projects ADD COLUMN IF NOT EXISTS execution_mode TEXT NOT NULL DEFAULT '';
+
+-- +goose Down
+ALTER TABLE projects DROP COLUMN IF EXISTS execution_mode;
+ALTER TABLE projects DROP COLUMN IF EXISTS compliance_profile;
+ALTER TABLE projects DROP COLUMN IF EXISTS project_type;

internal/swboot/allowlist.go

@@ -0,0 +1,6 @@
+package swboot
+
+// RepoAllowlist is the SWBOOT-10 stub: no real patch/merge until approved.
+func RepoAllowlist() []string { return nil }
+
+func PatchAllowed(_ string) bool { return false }

internal/swboot/allowlist_test.go

@@ -0,0 +1,9 @@
+package swboot
+
+import "testing"
+
+func TestPatchDeniedByDefault(t *testing.T) {
+	if PatchAllowed("any") {
+		t.Fatal("SWBOOT-10 must deny until secondary approval")
+	}
+}