feat: v1 — boilerplate WxO + web

Boilerplate completo para construir soluciones agénticas sobre IBM
watsonx Orchestrate (ADK 2.x) con una capa web encima.

Destilado de cotemar-poc-n1 y dun-casos-prueba. Incluye:

- 11 docs (best practices, architecture patterns, ADK cheatsheet,
  observability, tool authoring, deployment, RUNBOOK, DEPLOY_TO_NEW_WOX,
  known-issues con 16 errores reales y fix, eval strategy, INDEX)
- 13 templates WxO (orchestrator/specialist/single-meta agents,
  3 connections, KB + runbook, observable_tool decorator, coercion
  helpers, Python tools, OpenAPI spec, backend filter endpoint, webhook
  validator HMAC, MCP connection)
- 6 scripts (deploy idempotente con fallback ADK, undeploy, reset,
  check-adk-version, new-specialist scaffold, eval-agents runner)
- 4 eval pieces (linter de best practices, runner, smoke-test, direct
  backend probe) + scenario templates
- 8 subagentes Claude (.claude/agents/) — wxo-architect, wxo-agent-author,
  wxo-tool-author, runbook-author, mock-builder, backend-tool-builder,
  eval-author, web-layer-builder
- Skill bundle fit-wxo-bootstrap/ (SKILL.md + 3 templates) listo para
  copiar a ~/.claude/skills/
- Web layer default FastAPI+HTMX con vista timeline observable + endpoint
  receptor de trazas
- Docker compose Coolify-ready (healthcheck wget -qO-, sin labels Traefik,
  network split internal:true)
- CI Gitea workflow con lint + smoke

Best practices enforced por evals/lint_wxo_yaml.py:
- A1: máx 10 tools por agente
- A3: orchestrator sin tools de remediación
- A6: agente sin propósito (react sin tools ni KB)
- T1: @observable_tool obligatorio, no @tool directo
- T3: _compat shim inline en tools.py
- D1: docker-compose sin wget --spider
- I-005: OpenAPI con description per-operation
- I-009: sin labels Traefik manuales

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/check-adk-version.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Compara la versión pineada (2.1.0) con la última disponible en PyPI.
+# Warnea si hay nueva pero NO actualiza automáticamente — Felipe debe correr
+# las evals antes de bumpear.
+
+set -euo pipefail
+
+PINNED="2.1.0"
+PACKAGE="ibm-watsonx-orchestrate"
+
+echo "→ Checking ADK version..."
+echo "  Pinned: $PINNED"
+
+INSTALLED=$(pip show "$PACKAGE" 2>/dev/null | grep -i '^version:' | awk '{print $2}' || echo "not-installed")
+echo "  Installed: $INSTALLED"
+
+LATEST=$(curl -s "https://pypi.org/pypi/$PACKAGE/json" | python3 -c "import sys, json; print(json.load(sys.stdin)['info']['version'])" 2>/dev/null || echo "unknown")
+echo "  Latest on PyPI: $LATEST"
+
+if [ "$INSTALLED" != "$PINNED" ]; then
+  echo ""
+  echo "⚠  Installed ($INSTALLED) does NOT match pinned ($PINNED)."
+  echo "   Run:  pip install '${PACKAGE}==${PINNED}'"
+fi
+
+if [ "$LATEST" != "$PINNED" ] && [ "$LATEST" != "unknown" ]; then
+  echo ""
+  echo "ℹ  Nueva versión disponible en PyPI: $LATEST  (pin: $PINNED)"
+  echo "   ANTES de actualizar:"
+  echo "     1. Crear branch chore/adk-$LATEST"
+  echo "     2. pip install '${PACKAGE}==${LATEST}'"
+  echo "     3. ./evals/eval-agents.sh   ← TODAS deben pasar"
+  echo "     4. Si pasan, bumpear el pin en wxo/tools/python/requirements.txt y este script"
+fi
+
+echo ""
+echo "→ Verificando modelo preferido (gpt-oss-120b)..."
+if orchestrate models list 2>/dev/null | grep -q "gpt-oss-120b"; then
+  echo "  ✓ gpt-oss-120b disponible"
+else
+  echo "  ⚠  gpt-oss-120b NO encontrado en este tenant"
+  echo "    Fallback documentado: meta-llama/llama-3-3-70b-instruct (con caveat I-002)"
+fi