docs(work): scaffold conformance-hardening-v1 epic + stories

docs/work/conformance-hardening-v1/01-ast-manifest-source/_story.md

@@ -0,0 +1,33 @@
+---
+id: 01-ast-manifest-source
+epic: conformance-hardening-v1
+title: Replace regex manifest source parser with AST
+type: technical-story
+status: in-progress
+feature: core-eslint
+depends-on: []
+blocks: [02-dev-seed-assertion]
+---
+
+## Goal
+`readManifestSource` in `_manifest-source.js` returns the same shape but
+uses `@typescript-eslint/parser` AST traversal instead of regex.
+
+## In scope
+- Rewrite `readManifestSource` to delegate to a new `parseManifestFully`
+  in `_manifest-ast.js` that returns `{ name, requiredCores, useCases }`
+- Existing 4 tests for `readManifestSource` must still pass
+- Add tests covering the previously-fragile cases: `name:` in JSDoc,
+  single-quoted strings, manifest declared with `let` instead of `const`
+
+## Out of scope
+- Changing the `_manifest-source.js` exports surface (filesystem helpers
+  `manifestPathForFeature` and `featureRootForFile` stay untouched)
+- Changing any rule's behaviour beyond the parsing path
+
+## Tasks
+- [ ] Epic + story scaffold
+- [ ] Extend `_manifest-ast.js` with `parseManifestFully`
+- [ ] Switch `readManifestSource` to delegate to `parseManifestFully`
+- [ ] Add edge-case tests
+- [ ] Verify all rules still pass; commit

docs/work/conformance-hardening-v1/02-dev-seed-assertion/_story.md

@@ -0,0 +1,29 @@
+---
+id: 02-dev-seed-assertion
+epic: conformance-hardening-v1
+title: Extend assertFeatureConformance to all bind-dev-seed paths
+type: technical-story
+status: todo
+feature: <cross-feature>
+depends-on: [01-ast-manifest-source]
+blocks: []
+---
+
+## Goal
+Each feature's `bind-dev-seed.ts` calls `assertFeatureConformance(...)`
+at its tail, matching the bind-production pattern.
+
+## In scope
+- Update bind-dev-seed.ts in auth, blog, media, navigation, marketing-pages
+- Each gets the same import + tail call as its bind-production sibling
+
+## Out of scope
+- Behavioural changes to dev-seed binders
+
+## Tasks
+- [ ] Update auth bind-dev-seed
+- [ ] Update blog bind-dev-seed
+- [ ] Update media bind-dev-seed
+- [ ] Update navigation bind-dev-seed
+- [ ] Update marketing-pages bind-dev-seed
+- [ ] Verify pnpm test passes

docs/work/conformance-hardening-v1/_epic.md

@@ -0,0 +1,27 @@
+---
+id: conformance-hardening-v1
+prd: null
+title: Conformance hardening v1 — AST manifest parsing + dev-seed boot assertion
+type: epic
+status: in-progress
+features: [core-eslint, auth, blog, media, navigation, marketing-pages]
+created: 2026-05-13
+---
+
+## Goal
+Tighten two known fragilities in conformance-system-v1:
+1. `_manifest-source.js` uses regex for `name` + `requiredCores` extraction —
+   replace with AST parsing for correctness (comments, quote styles, edge cases)
+2. Boot assertion only runs at the production binder's tail. Dev mode
+   (`USE_DEV_SEED=true`) skips it. Extend to dev-seed paths.
+
+## Why
+- The regex false-match concern was flagged by the milestone iii.a final
+  reviewer and held only by today's convention; a future manifest with
+  a `// name: "x"` comment would break `required-cores-installed`.
+- `pnpm dev` is the inner loop. Drift in dev-seed binders is currently
+  invisible until production boot — too late.
+
+## Stories
+- [ ] [01 — AST-based manifest source parser](01-ast-manifest-source/_story.md)
+- [ ] [02 — Dev-seed boot assertion across all 5 features](02-dev-seed-assertion/_story.md)