docs: add invariants.md, the runtime safety invariant registry

[aparajon]

Why this matters

SchemaBot's safety model lives in many places — the merge-gate rules in check-runs.md, the state machine in apply-lifecycle.md, lease semantics in code comments, and a long trail of merged PRs. An operator reasoning about a change during an incident, or a reviewer deciding whether a PR weakens a guarantee, has no single place that says what must never be false at runtime. Tier-0 services deserve that registry.

What it does

Adds docs/invariants.md: 56 runtime safety invariants in 8 categories — merge gate (MG), apply state machine (ST), ownership and leases (OW), control operations (CO), recovery (RC), review integrity and data safety (RV), routing and authorization (AZ), and availability and blast radius (AV). Each invariant states the rule, what breaks if it is violated, and where it is enforced. The doc opens with the three principles most invariants derive from (fail closed on uncertainty; started applies remain authoritative; a finished apply stays finished), closes with the structurally-enforced meta-invariants (state-registry completeness, route-table sweep, engine conformance, claim parity), and separates runtime invariants from the engineering rules that live in AGENTS.md.

Every entry describes shipped, enforced behavior — this is a registry, not a wishlist. The intent is that PRs touching code near an invariant treat it as the review bar: weakening one requires saying so and updating this document.

---

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a new documentation registry, docs/invariants.md, intended to centralize SchemaBot’s runtime safety invariants so operators and reviewers have a single reference for “must never be false at runtime” guarantees.

Changes:

• Introduces a comprehensive invariants registry (56 invariants across 8 categories) with rationale and enforcement pointers.
• Adds a “Structural enforcement” section describing CI-enforced meta-invariants (state completeness, route-table sweep, engine conformance, claim parity).

Suppressed comments (1)

docs/invariants.md:607

• This enforcement reference has the same malformed inline code formatting: backticks only wrap pkg/webhook and the parenthetical never closes cleanly on the first line, which breaks Markdown rendering.

*Enforced:* the durable webhook inbox (`pkg/webhook` durable dispatch,
`webhook_events` storage).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.