refactor(work): drop date prefixes + move _state.json into _system/

Convention shift: epic folders + PRD filenames + frontmatter id
fields are now bare slugs. The created: timestamp (Phase 2) carries
the date; folder names don't repeat it. A future <task-id>-<slug>
shape (e.g. ClickUp) lands cleanly when that integration ships.

Renames (git mv preserves history):
- docs/work/2026-05-13-binder-wrap-helper/
    -> docs/work/binder-wrap-helper/
- docs/work/2026-05-14-library-evaluation-policy/
    -> docs/work/library-evaluation-policy/
- docs/work/2026-05-14-ci-security-and-supply-chain/
    -> docs/work/ci-security-and-supply-chain/
- docs/work/prds/2026-05-13-binder-wrap-helper.prd.md
    -> docs/work/prds/binder-wrap-helper.prd.md
- docs/work/prds/2026-05-13-coverage-architecture.prd.md
    -> docs/work/prds/coverage-architecture.prd.md
- docs/work/prds/2026-05-14-library-evaluation-policy.prd.md
    -> docs/work/prds/library-evaluation-policy.prd.md
- docs/work/prds/2026-05-14-ci-security-and-supply-chain.prd.md
    -> docs/work/prds/ci-security-and-supply-chain.prd.md

Frontmatter updates inside the renamed files: epic id, epic prd,
story epic, PRD id, PRD builds-on all drop date prefixes.

System folder + state file move:
- New docs/work/_system/ holds framework-managed state.
- docs/work/_state.json -> docs/work/_system/_state.json.
- state-builder.mjs adds _system to SKIP_FOLDERS.
- cli.mjs + state-sync-guard.mjs + .husky/pre-commit point at the
  new path.

template-reset-v1 epic deleted entirely (one-off cleanup epic from
the pre-date-convention era; status was already done).

Generator-template updates (so new artifacts ship in the right
shape):
- .sandcastle/decomposer.prompt.md emits bare-slug folder names +
  ISO created: timestamp.
- .claude/skills/to-prd/SKILL.md template uses bare-slug filename +
  bare-slug id field + ISO created: timestamp.

Doc reference updates: glossary, runbook, agent-first-workflow-
and-conformance, reviewer prompt, ADR-020, ADR-022, ADR-023 all
point at the new paths/slugs.

scripts/work/state-sync-guard.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Pre-commit guard: refuses the commit if docs/work/_state.json is staged
+ * Pre-commit guard: refuses the commit if docs/work/_system/_state.json is staged
  * but is not byte-identical to what `pnpm work rebuild-state` would emit
  * given the current markdown content of docs/work/.
  *
@@ -23,34 +23,45 @@ import { buildState } from "./state-builder.mjs";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = path.resolve(__dirname, "..", "..");
 const WORK_ROOT = path.join(REPO_ROOT, "docs", "work");
-const STATE_FILE = path.join(WORK_ROOT, "_state.json");
+const STATE_FILE = path.join(WORK_ROOT, "_system", "_state.json");
 
 function stagedFiles() {
-  const out = execSync("git diff --cached --name-only", { cwd: REPO_ROOT, encoding: "utf8" });
+  const out = execSync("git diff --cached --name-only", {
+    cwd: REPO_ROOT,
+    encoding: "utf8",
+  });
   return out.split("\n").filter(Boolean);
 }
 
 function main() {
   const staged = stagedFiles();
   const stateRel = path.relative(REPO_ROOT, STATE_FILE);
-  if (!staged.includes(stateRel) && !staged.some((f) => f.startsWith("docs/work/") && f.endsWith(".md"))) {
+  if (
+    !staged.includes(stateRel) &&
+    !staged.some((f) => f.startsWith("docs/work/") && f.endsWith(".md"))
+  ) {
     process.exit(0);
   }
   if (!fs.existsSync(STATE_FILE)) {
-    console.error("✗ state-sync-guard: docs/work/_state.json missing. Run `pnpm work rebuild-state`.");
+    console.error(
+      "✗ state-sync-guard: docs/work/_system/_state.json missing. Run `pnpm work rebuild-state`.",
+    );
     process.exit(1);
   }
   const onDisk = fs.readFileSync(STATE_FILE, "utf8");
   const fresh = JSON.stringify(buildState(WORK_ROOT), null, 2) + "\n";
   // The `updated_at` timestamp will always differ. Strip it from both sides
   // before comparing.
-  const stripUpdatedAt = (s) => s.replace(/"updated_at":\s*"[^"]+",?\s*\n?/, "");
+  const stripUpdatedAt = (s) =>
+    s.replace(/"updated_at":\s*"[^"]+",?\s*\n?/, "");
   if (stripUpdatedAt(onDisk) === stripUpdatedAt(fresh)) {
     process.exit(0);
   }
-  console.error("✗ state-sync-guard: docs/work/_state.json is out of sync with markdown.");
+  console.error(
+    "✗ state-sync-guard: docs/work/_system/_state.json is out of sync with markdown.",
+  );
   console.error("   Run: pnpm work rebuild-state");
-  console.error("   Then: git add docs/work/_state.json");
+  console.error("   Then: git add docs/work/_system/_state.json");
   process.exit(1);
 }