refactor(work): drop date prefixes + move _state.json into _system/

Convention shift: epic folders + PRD filenames + frontmatter id
fields are now bare slugs. The created: timestamp (Phase 2) carries
the date; folder names don't repeat it. A future <task-id>-<slug>
shape (e.g. ClickUp) lands cleanly when that integration ships.

Renames (git mv preserves history):
- docs/work/2026-05-13-binder-wrap-helper/
    -> docs/work/binder-wrap-helper/
- docs/work/2026-05-14-library-evaluation-policy/
    -> docs/work/library-evaluation-policy/
- docs/work/2026-05-14-ci-security-and-supply-chain/
    -> docs/work/ci-security-and-supply-chain/
- docs/work/prds/2026-05-13-binder-wrap-helper.prd.md
    -> docs/work/prds/binder-wrap-helper.prd.md
- docs/work/prds/2026-05-13-coverage-architecture.prd.md
    -> docs/work/prds/coverage-architecture.prd.md
- docs/work/prds/2026-05-14-library-evaluation-policy.prd.md
    -> docs/work/prds/library-evaluation-policy.prd.md
- docs/work/prds/2026-05-14-ci-security-and-supply-chain.prd.md
    -> docs/work/prds/ci-security-and-supply-chain.prd.md

Frontmatter updates inside the renamed files: epic id, epic prd,
story epic, PRD id, PRD builds-on all drop date prefixes.

System folder + state file move:
- New docs/work/_system/ holds framework-managed state.
- docs/work/_state.json -> docs/work/_system/_state.json.
- state-builder.mjs adds _system to SKIP_FOLDERS.
- cli.mjs + state-sync-guard.mjs + .husky/pre-commit point at the
  new path.

template-reset-v1 epic deleted entirely (one-off cleanup epic from
the pre-date-convention era; status was already done).

Generator-template updates (so new artifacts ship in the right
shape):
- .sandcastle/decomposer.prompt.md emits bare-slug folder names +
  ISO created: timestamp.
- .claude/skills/to-prd/SKILL.md template uses bare-slug filename +
  bare-slug id field + ISO created: timestamp.

Doc reference updates: glossary, runbook, agent-first-workflow-
and-conformance, reviewer prompt, ADR-020, ADR-022, ADR-023 all
point at the new paths/slugs.

.claude/skills/to-prd/SKILL.md

@@ -15,7 +15,7 @@ The PRD lives on the filesystem (this repo does not use an issue tracker for wor
 
    Check with the user that this module sketch matches their expectations. Confirm which modules they want tests written for. (The conformance system already mandates tests for every use case + controller; this question is about extra coverage — repository contract suites, integration tests, etc.)
 
-3. **Pick a slug + date** for the PRD filename: `docs/work/prds/<YYYY-MM-DD>-<kebab-slug>.prd.md`. Use today's date.
+3. **Pick a slug** for the PRD filename: `docs/work/prds/<kebab-slug>.prd.md`. No date prefix in the slug — the `created:` timestamp in frontmatter carries the date. Future task-tracker IDs (e.g. ClickUp) will land as `<task-id>-<kebab-slug>` once that integration ships; until then, bare slug only.
 
 4. **Write the PRD using the template below**, then save it. Status starts at `draft`. The decomposer (`pnpm work decompose`) refuses to run on `draft` PRDs — the human flips it to `approved` after review.
 
@@ -23,13 +23,13 @@ The PRD lives on the filesystem (this repo does not use an issue tracker for wor
 
 ```markdown
 ---
-id: <YYYY-MM-DD>-<kebab-slug>
+id: <kebab-slug>
 title: <Human-readable title>
 type: prd
 status: draft
 author: <user>
 elicitation-session: <agent-session-id-or-omit>
-created: <YYYY-MM-DD>
+created: <ISO-8601-UTC-timestamp, e.g. 2026-05-14T19:23:45Z>
 ---
 
 ## Problem
@@ -103,6 +103,6 @@ Anything else: stakeholders, related PRDs (`Builds on <prd-id>`, `Supersedes <pr
 
 ## After writing
 
-- Verify the file lives at `docs/work/prds/<date>-<slug>.prd.md`.
+- Verify the file lives at `docs/work/prds/<slug>.prd.md`.
 - Tell the user the path and remind them to review and flip `status: draft → approved` before running `pnpm work decompose`.
 - If new domain terms were introduced or sharpened during synthesis, append them to `docs/glossary.md` (lazy-create if missing) — same rules as `grill-with-docs`.