feat(tireless): scaffold workspace, dashboard and staged design plan

Autonomous issue-to-PR driver for Claude Code and OpenCode, structured per
lair/architecture generic.md.

Workspace: entities/core/data/agent library crates plus api, worker and cli
binaries. Two pieces of real logic land with tests — lane routing (cc for
judgement, oc for specification) and the limit governor.

Constraints encoded as code rather than comments:
- agents are spawned as vendor binaries; tireless never calls a provider API
- ANTHROPIC_API_KEY is never set by tireless, only passed through
- assert_not_anthropic refuses to start an OpenCode lane pointed at Anthropic
- every run passes the governor; provider rate-limit signals win over our own
  accounting

Deployment assets target bob.hanzalova.internal:23296 (registered in
port-allocations.md), fronted by hanzalova at tireless.internal.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DHhHtohxcdk1PL3tfnYJdH

readme.md

@@ -0,0 +1,74 @@
+# tireless
+
+Watches labelled issues on Gitea (and GitHub, for legacy repos), claims them, and
+either decomposes them into an epic with child issues or implements them and
+opens a pull request. A human reviews everything; nothing merges itself.
+
+Two coding agents do the work, each spawned as the vendor's own binary:
+
+- **Claude Code** — planning, and implementation of issues that need
+  interpretation. Uses the operator's Claude subscription by default, or
+  pay-as-you-go if an API key is supplied.
+- **OpenCode** — implementation of issues that a tireless plan already specified,
+  against the self-hosted [helexa](https://git.lair.cafe/helexa/helexa) fleet.
+  Never Anthropic; enforced at startup.
+
+The rule of thumb: **Claude Code gets judgement, OpenCode gets specification.**
+
+Full design, constraints and the staged implementation plan:
+[`doc/plan/design.md`](doc/plan/design.md).
+
+## Status
+
+Stage 0 (foundations) is scaffolded. Ingestion, claiming and the agent lanes are
+not built yet — see §7 of the design document for what lands when.
+
+## Build
+
+```sh
+cargo test --workspace
+cargo clippy --all-targets --all-features -- -D warnings
+cargo fmt --all
+
+cd dashboard && npm ci && npm run build
+```
+
+## Run locally
+
+```sh
+cargo run -p tireless-api -- --config ./config.toml
+cargo run -p tireless-worker -- --config ./config.toml poll
+cargo run -p tireless-worker -- --config ./config.toml run
+
+cd dashboard && npm run dev     # proxies /v1 to 127.0.0.1:23296
+```
+
+`tireless preflight` verifies configuration and credentials without starting a
+service: it reports which billing mode a Claude Code run would use and asserts
+the OpenCode lane is not pointed at Anthropic.
+
+## Deploy
+
+CI-driven via Gitea Actions on merge to `main`
+(`architecture/deployment-gitea-actions.md`). One-time host provisioning —
+including the interactive Claude Code login and the Gitea bot account — is
+`script/infra-setup.sh`.
+
+| | |
+| --- | --- |
+| Host | `bob.hanzalova.internal` |
+| API port | `23296` (registered in `architecture/port-allocations.md`) |
+| Dashboard | `https://tireless.internal` (mesh only) |
+| Database | `magrathea.kosherinata.internal:5432`, mTLS |
+
+## Conventions
+
+Follows [`lair/architecture`](https://git.lair.cafe/lair/architecture);
+`generic.md` is the baseline. Two deliberate deviations:
+
+- **`tireless-agent` crate** beyond the standard entities/core/data split.
+  Process orchestration is not data access, and it is shared by the runner and
+  the CLI. (§1)
+- **`MemoryDenyWriteExecute=false` on `tireless-runner`.** Both agents are Node
+  programs and V8's JIT needs write-then-execute pages. The API and poller keep
+  the setting. (§8)