feat: Add guild charters and task boards for various components

- Introduced guild charters for Scanner Deno, PHP, Ruby, Native, WebService, Java, Surface.Env, Surface.FS, Surface.Secrets, Surface.Validation, UI, Zastava Observer, Zastava Webhook, Zastava Core, and Plugin Platform.
- Each charter outlines the mission, scope, required reading, and working agreements for the respective guilds.
- Created task boards for Surface.Env, Surface.FS, Surface.Secrets, Surface.Validation, and Zastava components to track progress and dependencies.
- Ensured all documents emphasize determinism, offline readiness, security, and integration with shared Surface libraries.

src/Concelier/__Libraries/StellaOps.Concelier.Connector.StellaOpsMirror/AGENTS.md

@@ -0,0 +1,25 @@
+# Concelier Mirror Connector Charter
+
+## Mission
+Provide the connector that ingests advisory mirror bundles produced by Export Center / Mirror Creator into Concelier without external network calls. The connector must preserve bundle provenance, operate under the Aggregation-Only Contract, and support incremental replay for air-gapped deployments.
+
+## Scope
+- Connector code in `StellaOps.Concelier.Connector.StellaOpsMirror`.
+- Bundle validation (signatures, manifests, Merkle roots) and resumable cursor handling.
+- Integration with mirror ingestion pipelines and Offline Kit workflows.
+- Tests verifying deterministic behaviour across bundle versions.
+
+## Required Reading
+- `docs/modules/concelier/architecture.md`
+- `docs/ingestion/aggregation-only-contract.md`
+- `docs/modules/concelier/operations/mirror.md`
+- `docs/modules/export-center/architecture.md` (mirror profiles)
+- `docs/modules/airgap/airgap-mode.md`
+
+## Working Agreement
+1. **State updates**: mark tasks `DOING`/`DONE` in both `docs/implplan/SPRINTS.md` and `TASKS.md` when work begins/ends.
+2. **Provenance first**: record bundle identifiers (`bundle_id`, digests, time anchors) alongside every observation/linkset; never mutate raw documents.
+3. **Deterministic replay**: implement cursor storage and re-run safety (same bundle yields identical outputs).
+4. **Offline integrity**: validate signatures/hashes before ingest; emit actionable errors for stale/invalid bundles.
+5. **Testing**: maintain fixtures covering full/delta bundles, supersedes, and failure cases; run integration suite offline.
+6. **Docs**: update mirror connector guidance in `docs/modules/concelier/operations/mirror.md` whenever workflow changes.