refactor(work): move epic folders into docs/work/epics/

The previous layout placed epic folders directly under docs/work/
alongside prds/ and _system/. Tightening: epics now live in their
own docs/work/epics/ subfolder, peer to prds/ and _system/. Same
shape as the existing prds/ bucket.

Final docs/work/ layout:
  README.md
  prds/<slug>.prd.md
  _system/_state.json
  epics/<slug>/_epic.md + <story-folder>/_story.md

Renames (git mv preserves history):
- docs/work/binder-wrap-helper/
    -> docs/work/epics/binder-wrap-helper/
- docs/work/library-evaluation-policy/
    -> docs/work/epics/library-evaluation-policy/
- docs/work/ci-security-and-supply-chain/
    -> docs/work/epics/ci-security-and-supply-chain/

Tooling updates:
- state-builder.mjs walks workRoot/epics/ directly; SKIP_FOLDERS
  obsoleted (no more sibling folders to filter out).
- dispatch.mjs's findNextTask, tickStoryBulletInEpic, and
  flipEpicDoneIfAllStoriesDone all join with "epics" segment.
- prd-ship.mjs's deriveShippingCommits walks workRoot/epics/ and
  git-logs docs/work/epics/<epic>/.
- decomposer.prompt.md emits epics under docs/work/epics/<epic-id>/.
- handoff + grill-with-docs glossary references updated.
- Glossary entry for Epic updated.

Reserved future shape: when a task-tracker integration (ClickUp,
Linear) ships, the epics/ subfolder hosts <task-id>-<slug>/
folders. Today it just hosts bare slugs.

scripts/work/state-builder.mjs

@@ -1,13 +1,10 @@
 import fs from "node:fs";
 import path from "node:path";
 
-const SKIP_FOLDERS = new Set(["_templates", "_system", "prds"]);
-const SKIP_FILES = new Set(["README.md", "_state.json"]);
-
 /**
- * Walk the `docs/work/` tree starting at `workRoot` and return a structured
- * state object. Each epic folder must contain `_epic.md`; each story
- * subfolder must contain `_story.md`.
+ * Walk the `docs/work/epics/` tree under `workRoot` and return a structured
+ * state object. Each epic folder under `epics/` must contain `_epic.md`;
+ * each story subfolder must contain `_story.md`.
  *
  * Returns:
  * {
@@ -34,11 +31,11 @@ export function buildState(workRoot) {
     epics: {},
   };
 
-  if (!fs.existsSync(workRoot)) return state;
+  const epicsRoot = path.join(workRoot, "epics");
+  if (!fs.existsSync(epicsRoot)) return state;
 
-  for (const entry of fs.readdirSync(workRoot)) {
-    if (SKIP_FOLDERS.has(entry) || SKIP_FILES.has(entry)) continue;
-    const epicDir = path.join(workRoot, entry);
+  for (const entry of fs.readdirSync(epicsRoot)) {
+    const epicDir = path.join(epicsRoot, entry);
     if (!fs.statSync(epicDir).isDirectory()) continue;
     const epicFile = path.join(epicDir, "_epic.md");
     if (!fs.existsSync(epicFile)) continue;