[codex] Restore CI governance and test baseline

[helloJamest]

PR Type

• fix
• docs
• test
• chore

Background And Problem

The repository's engineering-trust baseline had drifted across AI governance assets, CI workflow coverage, documentation expectations, and local test output. The branch restores those guardrails before moving on to experience or capability work.

Scope Of Change

• Restores and guards AI collaboration governance assets and PR/CI workflow expectations.
• Adds CI coverage for backend, Docker smoke imports, web lint/test/build, PR static checks, and non-blocking network smoke checks.
• Stabilizes the offline pytest baseline by isolating local .env, optional dependencies, Windows file-lock and encoding behavior, and third-party warning noise.
• Migrates affected API schema examples/config to Pydantic v2 style and avoids OpenAPI schema-name collision.
• Makes newspaper3k optional for search-content fetches and adds a regression test for missing optional dependency behavior.
• Improves Agent runner final-answer fallback so non-streaming adapters or mocks do not produce empty final content.
• Adds Vitest canvas/scrollTo shims and runs Vitest in web-gate.
• Updates AGENTS.md and docs/CHANGELOG.md. README was not changed because this is internal governance/test/CI baseline work; detailed changes live in AGENTS, workflow tests, and CHANGELOG.

Issue Link

None.

Verification Commands And Results

• python -m pytest -m "not network" -q -> 1445 passed, 17 skipped, 2 deselected
• python scripts\check_ai_assets.py -> [ai-assets] OK
• flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics -> 0
• python -c "import pathlib, yaml; [yaml.safe_load(p.read_text(encoding='utf-8')) for p in pathlib.Path('.github/workflows').glob('*.yml')]; print('workflow yaml ok')" -> workflow yaml ok
• git diff --cached --check -> passed before commit
• npm.cmd test in apps/finagent-web -> 43 passed, 331 passed | 2 skipped
• npm.cmd run lint in apps/finagent-web -> passed
• npm.cmd run build in apps/finagent-web -> passed, with existing Browserslist staleness and chunk-size warnings

Compatibility And Risk

• No intentional breaking API change. The screener task accepted schema keeps the existing TaskAccepted alias while avoiding OpenAPI reference collision.
• newspaper3k remains optional at runtime; missing dependency now degrades article-content fetching to an empty body instead of failing module import.
• Warning filters are scoped to third-party lark_oapi/pkg_resources deprecation noise so project warnings should still surface.
• Docker build was not run locally because Docker is not installed in the current machine. A Docker smoke import was validated outside Docker, and CI should provide the authoritative Docker build result.
• scripts/ci_gate.sh was not run as a shell script locally because WSL/bash is unavailable; its key phases were validated through equivalent local checks.

Rollback Plan

Revert the branch commits in order, or revert the latest commit 026238f plus the earlier governance commit 53be9b2 if the whole restoration needs to be backed out.