[strategist] planning: add org-wide ROADMAP.md consolidating 17 strategic findings into 3 phases

[kubestellar-hive]

Planning Artifact

Adds ROADMAP.md (new file, root of common) — an org-wide roadmap consolidating 17 strategist findings (common#1028–#1067) into three phases:

• Phase 0 (0–30d): Unblock the review pipeline — hold-gate prioritization rubric ([strategist] Hold-gated PR queue has no prioritization rubric — 61 PRs (2x in 48h) compete flat for scarce human review #1043), agent output throttle ([strategist] Agent lanes have no output throttle — demand-side lever missing from review-bottleneck response #1052), reviewer-scaling rung ([strategist] Contributor ladder has no reviewer-scaling rung — triage/review capacity is the org bottleneck (74 issues in 1-triage, 32 aged >60d) #1029), triage SLA ([strategist] User-issue triage starvation: 50 human issues stuck in triage (17 aged >90d) while agent lanes hold 95 PRs #1067), obsolescence detection ([strategist] Hold-gated agent PRs silently superseded by merged human fixes — no obsolescence detection #1054).
• Phase 1 (30–90d): Consolidate — org-wide Actions security baseline ([strategist] Org-wide GitHub Actions security baseline needed — 9 sec-check PRs patching permissions/SHA-pinning piecemeal across 4 repos #1036), canonical image-identity schema ([strategist] Image-identity/variant metadata being 'single-sourced' independently in 9 repos — no org-wide canonical schema #1056), shared tooling in actions/scripts ([strategist] Per-repo tooling sprawl: diverged generate_skill_index.py copies (testsuite/fsdk-containers) + 6 unit-test PRs building per-repo script scaffolding — consolidate into actions/scripts #1040), release-gate policy ([strategist] Release-gate posture diverges across all 4 product lines — no org-wide stall/override policy #1028/[strategist] Gate erosion: chronically red release pipelines normalize shipping with gates skipped or failing #1057), repo lifecycle policy ([strategist] No repo lifecycle/portfolio policy: bootc-installer nightly red 30/30 runs since 2026-07-30 with no tracking issue, README still references legacy ghcr.io/ublue-os images #1041), agent-lane dedup ([strategist] Agent lanes self-colliding: duplicate hold-gated PRs for identical clusters (finpilot #285/#303, #296/#299) #1060/[strategist] Lifecycle inversion in server repo: 4 overlapping PXE PRs (#22/#25/#26/#27) implementing unapproved feature server#14 #1033).
• Phase 2 (90–180d): Product-defining decisions — systemd-homed default ([strategist] systemd-homed-by-default (dakota#962) is a product-defining decision sitting 70 days in review with no design record #1050), NVIDIA policy ([strategist] No org-wide NVIDIA support policy while bluefin-lts intentionally diverges from upstream nvidia-install.sh #1051), dakota adoption bar ([strategist] Dakota first-boot/login defect backlog is an adoption risk: 64 SLA-violating issues, oldest blockers 89-129d, while stable ships daily #1037), quality-lane CI integration ([strategist] Quality-lane output outpacing CI integration: orphaned/red test artifacts across 4 repos erode suite trust #1046).

Includes a success-metrics table (hold-gated PR count, triage age, security baseline coverage, identity schema count) so progress is measurable. Narrowed successor to the closed org-wide ROADMAP attempt (common#958).

Files claimed: ROADMAP.md (new) only. No overlap with any open hold-gated PR — none touch ROADMAP.md.

Refs #1072

---

Filed by strategist agent (ACMM L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=strategist backend=copilot model=kimi-k3