docs(agentic-teams): document the new resources, and make the webhook reachable

Five resources shipped with no documentation and one documented lie:
docs/inference-tasks.md still told people `mcpctl get tasks` lists the
inference queue. Work items own that name now.

Adds docs/epics.md (the Epic -> EpicTask -> Task hierarchy, the state machine,
risk-scaled review gates, the accept-merges gate, and reconciliation),
docs/gitproviders.md (forge registration, discovery/import, merge-on-accept,
post-merge reopen) and docs/agent-authority.md (the three run modes, and
plainly which two are not implemented).

Two things found while writing them, both fixed rather than filed:

- `webhookSecretKey` was read by the webhook route but writable from NOWHERE
  -- absent from the create schema, update schema, service, CLI and apply
  spec. Since the endpoint fails closed on a null key, post-merge CI failures
  could never reopen their task; the board would keep claiming `merged` for
  work that broke the build. Adds --webhook-secret-key, the schema fields and
  the apply key, with tests covering persist / omit / explicit-null /
  reject-empty. Omission deliberately does not clear the column, so an
  unrelated edit cannot silently disarm the webhook.

- src/cli/src/commands/create.ts contained a literal NUL byte inside a string
  literal (a binary-file check written with the raw character rather than an escape). Identical behaviour, but it made the whole file read as
  binary, so `grep -I` skipped it entirely and 1120 lines of CLI were
  invisible to every text search. Replaced with the escape.

The Epic write path (criteria/status/tradeoffs) is API-only -- documented as
such rather than papered over, and filed as task 180.

Full suite 2612 green; lint at baseline 794/77.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N4wNHWf7xSwnZCWpJcyv9p

docs/inference-tasks.md

@@ -136,10 +136,21 @@ result is just discarded server-side.
 
 ## CLI
 
+> **Renamed.** This queue used to answer to `mcpctl get tasks`. Agentic-teams
+> **work items** own that name now, so the queue keeps only its explicit
+> spellings: `inference-tasks`, `inference-task`, `itasks`, `itask`. Bare
+> `tasks`/`task` list work items — see [epics.md](epics.md).
+>
+> The same split applies to RBAC: this queue is authorized by
+> `view:inference-tasks`, work items by `view:tasks`. Bindings written before
+> the split are rewritten once at startup, so an existing `view:tasks` grant
+> keeps working here and does **not** silently become a grant over work items.
+
 ```sh
-mcpctl get tasks                # table view: ID, STATUS, POOL, LLM, MODEL, STREAM, AGE, WORKER
-mcpctl get task <id>            # describe one
-mcpctl get task <id> -o yaml    # full row, yaml format
+mcpctl get inference-tasks      # table view: ID, STATUS, POOL, LLM, MODEL, STREAM, AGE, WORKER
+mcpctl get itasks               # short alias
+mcpctl get inference-task <id>          # describe one
+mcpctl get inference-task <id> -o yaml  # full row, yaml format
 
 # Enqueue async via chat-llm:
 mcpctl chat-llm vllm-local-qwen3 --async -m "summarize the changelog"