Add the docs/decisions scaffold

Andrew Dunnrequested to merge
docs/decisions-scaffold into master

What does this MR do?

Adds docs/decisions/, the home for stig-analyzer's standing Architecture Decision Records (ADRs). Decisions with lasting consequences live here, separate from the plan-of-record epic, so the epic's description can stay timeless.

  • docs/decisions/README.md: explains the ADR lifecycle (Proposed, Accepted, Superseded) and indexes the series

  • docs/decisions/template.md: the frontmatter and section skeleton new ADRs are copied from

  • docs/decisions/0001-input-contract-stability.md: seeded as Proposed. #4 (M3: Quality substrate) already names an input-contract stability ADR as an exit criterion, so this file states that policy now (additive-only inputs within a major version, a deprecation window for removals, enforced through the existing semver release train) rather than waiting on M3 to start. It moves to Accepted on its own review.

  • One docs/decisions/ link and one Roadmap line added to README.md, pointing at the plan-of-record epic

No seed ADRs beyond 0001 are added. Backfilling ADRs for decisions already made elsewhere in the project's history is separate follow-up work, not part of this scaffold.

Related issues

Relates to #4 (M3: Quality substrate), which names the seeded ADR as an exit criterion.

Part of the plan tracked at &1.

Documentation updates

This MR is documentation only: a new docs/decisions/ directory, a README.md link, no code or runtime behavior change.

CHANGELOG.md updated

Yes, under Unreleased -> Added.

Checklist

  • README.md updated
  • CHANGELOG.md updated
  • Security documentation updated (if applicable) - N/A, no security-relevant change
  • Usage examples added (for new features) - N/A, not a runtime feature or input change
  • Pipeline passes (docs-only change; any red is expected to be the known Duo entitlement canary, unrelated to this diff)

Merge request reports