feat: Add guild charters and task boards for various components

- Introduced guild charters for Scanner Deno, PHP, Ruby, Native, WebService, Java, Surface.Env, Surface.FS, Surface.Secrets, Surface.Validation, UI, Zastava Observer, Zastava Webhook, Zastava Core, and Plugin Platform.
- Each charter outlines the mission, scope, required reading, and working agreements for the respective guilds.
- Created task boards for Surface.Env, Surface.FS, Surface.Secrets, Surface.Validation, and Zastava components to track progress and dependencies.
- Ensured all documents emphasize determinism, offline readiness, security, and integration with shared Surface libraries.

src/Zastava/StellaOps.Zastava.Observer/AGENTS.md

@@ -0,0 +1,29 @@
+# Zastava Observer Guild Charter
+
+## Mission
+Implement the node-level observer that monitors running workloads, detects drift, enforces posture policies, and emits runtime evidence. The service must integrate with Surface libraries, operate in offline/air-gapped environments, and respect tenancy/security constraints.
+
+## Scope
+- Observer DaemonSet host under `StellaOps.Zastava.Observer` (process inventory, drift detection, event emission).
+- Integration with Scanner Surface.FS/Env/Secrets/Validation.
+- Runtime event pipelines feeding Scanner, Policy, Scheduler, and Notify.
+- Telemetry/logging ensuring observability and audit trails.
+
+## Required Reading
+- `docs/modules/zastava/architecture.md`
+- `docs/modules/scanner/design/surface-fs.md`
+- `docs/modules/scanner/design/surface-env.md`
+- `docs/modules/scanner/design/surface-secrets.md`
+- `docs/modules/scanner/design/surface-validation.md`
+- `docs/modules/scanner/architecture.md` (runtime posture sections)
+- `docs/modules/airgap/airgap-mode.md`
+- Any runtime-specific design notes referenced in `TASKS.md`.
+
+## Working Agreement
+1. **Status updates**: mark tasks `DOING`/`DONE` in both `docs/implplan/SPRINTS.md` and local `TASKS.md` when starting/finishing work.
+2. **Surface compliance**: rely on Surface libraries for cache/env/secret handling; run validators before collecting evidence.
+3. **Deterministic evidence**: normalise timestamps, hashes, and paths; ensure outputs remain stable for replay/audit.
+4. **Security**: enforce Authority scopes (OpToks, mTLS/DPoP), redaction of sensitive fields, and namespace isolation.
+5. **Offline readiness**: avoid external network calls; provide clear errors for missing bundles/secrets.
+6. **Testing**: maintain unit/integration/e2e tests for drift detection, event emission, and failure scenarios; support offline test runs.
+7. **Documentation**: update Zastava operations docs when behaviour changes; coordinate with DevOps on deployment manifests.

src/Zastava/StellaOps.Zastava.Observer/TASKS.md

@@ -2,5 +2,8 @@
 
 | ID | Status | Owner(s) | Depends on | Description | Exit Criteria |
 |----|--------|----------|------------|-------------|---------------|
+| ZASTAVA-SURFACE-01 | TODO | Zastava Observer Guild | SURFACE-FS-02 | Integrate Surface.FS client for runtime drift detection (lookup cached layer hashes/entry traces). | Observer validates runtime vs cache; integration tests cover drift + cache-miss cases. |
+| ZASTAVA-ENV-01 | TODO | Zastava Observer Guild | SURFACE-ENV-02 | Adopt Surface.Env helpers for cache endpoints, secret refs, and feature toggles. | Observer configuration centralised; misconfiguration warnings logged; docs updated. |
+| ZASTAVA-SECRETS-01 | TODO | Zastava Observer Guild, Security Guild | SURFACE-SECRETS-02 | Retrieve CAS/attestation access via Surface.Secrets instead of inline secret stores. | Secrets resolved through shared provider; rotation/resilience tests pass. |
 
 > 2025-10-24: Observer unit tests pending; `dotnet restore` requires offline copies of `Google.Protobuf`, `Grpc.Net.Client`, `Grpc.Tools` in `local-nuget` before execution can be verified.