Roadmap: From Read-Only Posture to Constrained Write

The preconditions Phase 3 constrained write requires in Digital Coworker — deterministic validation layer, diff-level audit, blast-radius constraints, and approval boundaries.