feat: sync the kit — deploy promotion, dependency position, fleet telemetry (1.1.0)

[MCKRUZ]

Regenerates harness/ from delivery-standard/kit (138 files, verified in sync) and wires the new files into the installer.

Pairs with MCKRUZ/intent-driven-development#39, #40, #41 — merge those first; this ships their payload.

What the installer needed, and why syncing in the same batch mattered

The test suite found three things the standard's own repo cannot see. This is the argument for not deferring the sync:

1. Five new payload files installed nowhere. test_payload_completeness caught all five. The three closing-phase skeletons map to their final names (ROLLBACK.md, ALERTS.md, INCIDENT-PLAYBOOK.md) rather than a templates directory — unlike specs and spikes there is exactly one of each per repo, the same reasoning that puts CLAUDE.md.template at CLAUDE.md.

2. Adding those mappings then failed 53 tests, correctly. The installer fails closed on any FILE_MAP source missing from the payload, and the synthetic fixture had not grown with the map. The fixture was wrong, not the invariant — so the fixture grew.

3. The golden enterprise-tree snapshot gained exactly nine entries. That is the useful artifact here: proof that a real install now produces the promotion workflow, the dependency gate's scan and ledger, the telemetry report and schema, dependabot, and the three skeletons.

+.github/dependabot.yml
+.github/dependency-exceptions.md
+.github/rails-telemetry.schema.json
+.github/workflows/dependency-scan.yml
+.github/workflows/deploy-promote.yml
+.github/workflows/rails-telemetry.yml
+ALERTS.md
+INCIDENT-PLAYBOOK.md
+ROLLBACK.md

Version: minor, and the judgement is worth stating

dependency-gate is a new blocking required check, which by this project's own convention reads as breaking. I went 1.1.0 because nothing changes in an installed repo until an operator runs /sdlc-upgrade and re-applies branch protection — both deliberate, scripted actions. The migration note leads with that rather than burying it.

Say so if you'd rather this were 2.0.0 — it is a defensible read and easy to change before merge.

Test plan

• uv run --project scripts python -m pytest scripts/tests -q — 532 passed, 6 skipped, identical to the pre-sync baseline
• python scripts/sync_kit.py --check — in sync, 138 files
• harness/ is generated; no file in it was hand-edited

🤖 Generated with Claude Code

[MCKRUZ]

Version confirmed: 1.1.0 stands. Matt's call, 2026-08-01.

Rationale on record: dependency-gate is a new blocking required check, but nothing changes in an installed repo until someone runs /sdlc-upgrade and re-applies branch protection — two deliberate acts. Minor is the honest signal.

[MCKRUZ]

Merge-order note: the #29–#36 fix stack (#37 → #38 → #39 → #40) now ships as 1.0.1, bumped from the same 1.0.0 tree this PR is based on.

Please merge that stack before this one. Landing 1.1.0 first would make the 1.0.1 bump a version regression, and plugin.json / marketplace.json / CHANGELOG.md would need hand-reconciling.

Merged in the right order, this PR takes a trivial conflict on those three files: keep 1.1.0 for the version, and keep both changelog sections with ## 1.1.0 above ## 1.0.1.