Add strategy/runbooks.json — NEXUS runbook rosters by slug + CI guard (#664)

The app can't reliably resolve runbook rosters from display names (catalog
slugs are inconsistently division-prefixed, and names drift). This adds a
machine-readable manifest so the app reads rosters as data and maps each
slug to a catalog agent for one-click team deploy.

- strategy/runbooks.json: the 4 NEXUS scenarios (startup-mvp,
  enterprise-feature, marketing-campaign, incident-response), each with
  mode, duration, summary, doc, and a grouped roster. Every agents[] entry
  is a verified slug = the agent .md filename stem (the corpus id), resolved
  against the live roster — not a slugified display name. (Notably
  "Senior Project Manager" is project-manager-senior, NOT
  project-management-senior-project-manager, which naive mapping assumes.)
- scripts/check-runbooks.sh + .github/workflows/check-runbooks.yml: guard
  (mirrors check-divisions.sh) failing the build if any roster slug doesn't
  resolve to a real agent file, a doc path is missing, or JSON is malformed —
  so renaming/removing an agent can't silently break the app's deploy.

All 64 slug references verified; guard passes and fails correctly.


Claude-Session: https://claude.ai/code/session_01WKnDRWM4izsB8WAXKszhsq

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/check-runbooks.yml

@@ -0,0 +1,21 @@
+name: Check Runbooks Consistency
+
+# Runs on every PR (no path filter on purpose): renaming or removing an agent
+# must trip this check even when nobody touched strategy/runbooks.json, since a
+# dangling roster slug breaks the app's one-click team deploy.
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  check-runbooks:
+    name: runbook rosters reference real agent slugs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate runbook rosters
+        run: |
+          chmod +x scripts/check-runbooks.sh
+          ./scripts/check-runbooks.sh