feat: v1 — boilerplate WxO + web

Boilerplate completo para construir soluciones agénticas sobre IBM
watsonx Orchestrate (ADK 2.x) con una capa web encima.

Destilado de cotemar-poc-n1 y dun-casos-prueba. Incluye:

- 11 docs (best practices, architecture patterns, ADK cheatsheet,
  observability, tool authoring, deployment, RUNBOOK, DEPLOY_TO_NEW_WOX,
  known-issues con 16 errores reales y fix, eval strategy, INDEX)
- 13 templates WxO (orchestrator/specialist/single-meta agents,
  3 connections, KB + runbook, observable_tool decorator, coercion
  helpers, Python tools, OpenAPI spec, backend filter endpoint, webhook
  validator HMAC, MCP connection)
- 6 scripts (deploy idempotente con fallback ADK, undeploy, reset,
  check-adk-version, new-specialist scaffold, eval-agents runner)
- 4 eval pieces (linter de best practices, runner, smoke-test, direct
  backend probe) + scenario templates
- 8 subagentes Claude (.claude/agents/) — wxo-architect, wxo-agent-author,
  wxo-tool-author, runbook-author, mock-builder, backend-tool-builder,
  eval-author, web-layer-builder
- Skill bundle fit-wxo-bootstrap/ (SKILL.md + 3 templates) listo para
  copiar a ~/.claude/skills/
- Web layer default FastAPI+HTMX con vista timeline observable + endpoint
  receptor de trazas
- Docker compose Coolify-ready (healthcheck wget -qO-, sin labels Traefik,
  network split internal:true)
- CI Gitea workflow con lint + smoke

Best practices enforced por evals/lint_wxo_yaml.py:
- A1: máx 10 tools por agente
- A3: orchestrator sin tools de remediación
- A6: agente sin propósito (react sin tools ni KB)
- T1: @observable_tool obligatorio, no @tool directo
- T3: _compat shim inline en tools.py
- D1: docker-compose sin wget --spider
- I-005: OpenAPI con description per-operation
- I-009: sin labels Traefik manuales

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -0,0 +1,42 @@
+# ─── WxO tenant — usado por orchestrate CLI y Plan A webhook ─────────────────
+# Pattern: https://api.<region>.watson-orchestrate.cloud.ibm.com/instances/<uuid>
+ORCHESTRATE_API_URL=https://api.us-south.watson-orchestrate.cloud.ibm.com/instances/REPLACE_INSTANCE_UUID
+ORCHESTRATE_API_KEY=
+WATSONX_API_KEY=
+WATSONX_PROJECT_ID=
+
+# IAM endpoint para Plan A
+IBM_CLOUD_IAM_URL=https://iam.cloud.ibm.com/identity/token
+
+# UUID del agente orchestrator en el env LIVE (capturar tras deploy)
+WXO_AGENT_ID=
+WXO_INSTANCE_URL=${ORCHESTRATE_API_URL}
+WXO_API_KEY=${ORCHESTRATE_API_KEY}
+
+# ─── Token compartido backend ↔ WxO connections ──────────────────────────────
+# Custom header (no Bearer — issue C2)
+WXO_BACKEND_TOKEN=REPLACE_GENERATE_SECURE_TOKEN
+
+# ─── Observabilidad ──────────────────────────────────────────────────────────
+TRACE_SINK=http                                  # sqlite | http | otlp | off
+TRACE_SINK_URL=http://web:8000/api/traces
+TRACES_DB_PATH=/data/traces.db
+
+# ─── Webhook signing (si tu backend recibe webhooks de WxO) ──────────────────
+WEBHOOK_SECRET=REPLACE_GENERATE_HMAC_SECRET
+
+# ─── Host público ────────────────────────────────────────────────────────────
+PUBLIC_HOST=mi-cliente.fitlabs.dev
+
+# ─── Coolify (opcional, si deployás via API) ─────────────────────────────────
+COOLIFY_API_URL=https://coolify.fitlabs.dev/api/v1
+COOLIFY_API_TOKEN=
+COOLIFY_PROJECT_UUID=
+COOLIFY_APP_UUID=
+
+# ─── DB (si tu solución tiene backend) ──────────────────────────────────────
+DATABASE_URL=sqlite:///data/app.db
+
+# ─── Admin seed (rotar tras primer login) ────────────────────────────────────
+SEED_ADMIN_USERNAME=admin
+SEED_ADMIN_PASSWORD=REPLACE_GENERATE_SECURE_PASSWORD