feat: extract canonical work-issue workflow from monolithic skill (Closes #333)

Add workflows/work-issue.md with full author/coder gates (§0–§30),
work-issue final-report schema, task-mode router entry, start-issue template
link, and doc-contract tests.

Part of #333 workflow split (#334 review-merge extraction remains in PR #335).

skills/llm-project-workflow/schemas/work-issue-final-report.md

@@ -0,0 +1,73 @@
+# Work-issue controller handoff schema
+
+**Task mode:** `work-issue`
+
+End every work-issue run with a section titled exactly `Controller Handoff`.
+Use this canonical field set. Do not omit fields — use `none` or
+`not verified in this session` where appropriate.
+
+Do not use legacy fields: `Workspace mutations`, `Mutations: None` (when
+mutations occurred).
+
+```md
+## Controller Handoff
+
+- Task:
+- Repo:
+- Role:
+- Identity:
+- Active profile:
+- Runtime context:
+- Selected issue:
+- Eligibility class:
+- Issue ordering policy:
+- Issue inventory pagination proof:
+- Earlier issues skipped:
+- Duplicate active work proof:
+- Claim/lock state:
+- Stable branch:
+- Stable branch SHA:
+- Branch name:
+- Worktree path:
+- Worktree inside branches:
+- Worktree branch/HEAD state:
+- Worktree dirty before implementation:
+- Files changed:
+- Validation:
+- Baseline comparison:
+- Commit SHA:
+- Push result:
+- PR number:
+- PR URL:
+- PR verification:
+- Main checkout branch:
+- Main checkout dirty state:
+- Main checkout used for task work:
+- File edits by author:
+- Worktree/index mutations:
+- Git ref mutations:
+- MCP/Gitea mutations:
+- Issue mutations:
+- Branch mutations:
+- Commit mutations:
+- Push mutations:
+- PR mutations:
+- Cleanup mutations:
+- External-state mutations:
+- Read-only diagnostics:
+- Blockers:
+- Current status:
+- Safe next action:
+- Safety statement:
+```
+
+Identity format: `username / profile` (not personal email unless required — #305).
+
+Narrative final report and controller handoff must agree on eligibility class,
+selected issue, and mutation ledger categories (#319, #320).
+
+`git fetch` and ref-updating commands belong under `Git ref mutations`, not
+`Read-only diagnostics` (#297).
+
+Forbidden claims without proof (#330): `next eligible issue`, `issue claimed`,
+`validation passed`, `PR created`, `worktree clean`, `all gates passed`, etc.