docs: adopt Skill-first entry and canonical Job Workspace product model

[avabbbb]

Summary

Distills the Skill-first / Job Workspace direction into OfferU's current documentation authority, instead of leaving it as a standalone proposal.

The product model is now explicit:

Skill is the Agent entry; Job Workspace is the user product; Career Runtime is the shared truth.

OfferU has two front doors:

• App-first for normal users: install → auto-detect local Agent → project/register OfferU Skill where supported → save Job → canonical Job Workspace.
• Skill-first for power users: start inside a supported external Agent → enable OfferU Skill → analyze a Job → create/resolve the same canonical Job → open the same Job Workspace in OfferU.

Both paths converge on the same Profile / Job / Application state and audit boundaries.

What changed

Product authority

• GOAL.md

  • defines Job / Opportunity as a durable Job Workspace;
  • adds App-first and Skill-first lanes;
  • requires Agent results to materialize into the Workspace rather than live only in chat;
  • makes outcome-first messaging part of the product-claims contract.

• docs/product/current-product.md

  • adds the concrete Job → Role × Evidence → Workspace promise;
  • defines two front doors / one Career Truth;
  • defines Job Workspace as the durable product object;
  • adds progressive materialization and Plan → Review → Execute;
  • adds an outcome-first launch-story order.

Interaction / Agent authority

• docs/architecture/workbench-interaction.md

  • beginner flow now opens the Job Workspace;
  • Skill-first Power Mode must update the same canonical Workspace;
  • Job is no longer treated as only a detail page.

• docs/architecture/agent-system.md

  • explicitly defines Skill as an Agent entry surface, not a second project/database;
  • Agent work must resolve into the same OfferU state visible in Desktop;
  • adds compact preparation-plan behavior without approval spam.

Product-facing docs

• README.md + README_ZH.md
  • lead with the concrete user outcome instead of the broad “Career OS” category;
  • introduce the Role × Evidence formula and durable Job Workspace;
  • explain App-first vs Skill-first entry;
  • keep Career OS as the second-layer compounding story.

Documentation governance

• docs/README.md updated to reflect the new authority model.
• docs/product/skill-first-job-workspace-story.md is retained as design rationale / distilled reference, not a competing product authority.

External pattern reviewed

This direction borrows a useful interaction pattern from Agent-first tools such as Hypit:

• Skill gives the Agent domain knowledge;
• executable/product capabilities perform governed work;
• work persists in an editable project/workspace;
• later Agent requests update the same durable artifact;
• paid or materially broader work gets an explicit plan/budget decision.

OfferU deliberately adapts rather than copies that pattern:

• normal users remain App-first and zero-setup;
• no new OfferU DSL is introduced;
• Agent chat never owns Career Truth;
• Job Workspace remains canonical.

Validation

Documentation-only change. No runtime behavior or release-readiness claims are added. Current implementation/support claims remain governed by STATUS.md, release gates and live evidence.

Latest main integration

Rebased/realigned on the latest main baseline 967a28b3, which already contains the new four-part bug/security fix series:

• df1a4497 — critical security fixes;
• 3e0163b0 — high-severity fixes;
• dd1abe2d — medium-severity fixes;
• 967a28b3 — low-severity fixes + review corrections.

Those commits do not overlap this PR's eight documentation files. The PR is now 0 commits behind main and GitHub reports the branch as mergeable/clean. This keeps the new Job Workspace / Skill-first product authority on top of the repaired runtime baseline rather than on the older pre-fix snapshot.

The bug-fix commit messages are treated as implementation evidence only; this documentation PR does not convert them into release-readiness claims without the repository's normal test/release gates.

AGENTS.md alignment

AGENTS.md is now included so coding agents do not follow superseded repository rules while implementing the new product model.

Key fixes:

• adds the current documentation authority order;
• records App-first / Skill-first → one canonical Job Workspace as a hard implementation invariant;
• removes the obsolete “do not run tests/builds” instruction and requires scope-appropriate verification;
• removes the obsolete “no migration / old data compatibility needed” assumption and points schema/persistence work to current release migration + backup/restore gates;
• allows directly necessary adjacent files/tests without requiring the user to pre-list every path;
• adds regression guardrails from the 2026-09-23 security/reliability hardening baseline (SSRF, path traversal, sanitization/sandboxing, PII desensitization, auth, concurrency/idempotency, secret handling).