docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus

Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.

Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.

Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.

The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.

scripts/gen-rfc-index.ts

@@ -1,16 +1,17 @@
 /**
- * Regenerate the RFC index tables in `docs/rfc/README.md` from the RFC tree
- * (see [rfc-index.ts](./rfc-index.ts) for the layout contract and rendering
- * rules). Rewrites ONLY the marker-delimited regions; the curated prose is
- * untouched. Freshness is asserted by `verify-rfc-classification.ts` (a
- * `doc-sync` member), so a stale committed index fails CI.
+ * Regenerate `docs/rfc/INDEX.md` — the fully generated RFC index — from the
+ * RFC tree (see [rfc-index.ts](./rfc-index.ts) for the layout contract and
+ * rendering rules). The whole file is generated state; the curated prose lives
+ * in `docs/rfc/README.md`. Freshness is asserted by
+ * `verify-rfc-classification.ts` (a `doc-sync` member), so a stale committed
+ * index fails CI.
  *
  * Run: `pnpm run gen-rfc-index`.
  */
 
 import { readFileSync, writeFileSync } from 'node:fs'
 import { resolve } from 'node:path'
-import { rfcRoot, spliceReadme, walkRfcTree } from './rfc-index.ts'
+import { renderIndex, rfcRoot, walkRfcTree } from './rfc-index.ts'
 
 const { rfcs, errors } = walkRfcTree()
 if (errors.length > 0) {
@@ -19,12 +20,17 @@ if (errors.length > 0) {
   process.exit(1)
 }
 
-const readmePath = resolve(rfcRoot, 'README.md')
-const readme = readFileSync(readmePath, 'utf8')
-const next = spliceReadme(readme, rfcs)
-if (next === readme) {
-  console.log(`gen-rfc-index: docs/rfc/README.md is up to date (${rfcs.length} RFCs).`)
-} else {
-  writeFileSync(readmePath, next)
-  console.log(`gen-rfc-index: docs/rfc/README.md regenerated (${rfcs.length} RFCs).`)
+const indexPath = resolve(rfcRoot, 'INDEX.md')
+const next = renderIndex(rfcs)
+let current: string | undefined
+try {
+  current = readFileSync(indexPath, 'utf8')
+} catch {
+  // Missing INDEX.md is the fresh-generation case, not an error: fall through and write it.
+}
+if (next === current) {
+  console.log(`gen-rfc-index: docs/rfc/INDEX.md is up to date (${rfcs.length} RFCs).`)
+} else {
+  writeFileSync(indexPath, next)
+  console.log(`gen-rfc-index: docs/rfc/INDEX.md regenerated (${rfcs.length} RFCs).`)
 }