refactor(frontmatter): unified frontmatter contract + handoff spec (ORCH-52c)

src/frontmatter.py grows from a single-key reader into the full machine
contract: reader (read_frontmatter_value, unchanged), one parse primitive
(parse_frontmatter), writer (render/write_frontmatter), schema validator
(validate_schema/REQUIRED_FIELDS, warning-only by default) and a shared
strip_frontmatter helper. The five verdict gates (check_reviewer_verdict,
_parse_tests_verdict, _parse_deploy_status, _parse_staging_status,
parse_security_status) now read through the single parse_frontmatter point
instead of duplicated ad-hoc YAML logic; review_parse._strip_frontmatter and
security_gate.extract_security_findings reuse the shared helper.

Strictly backward compatible + never-raise: STAGE_TRANSITIONS, the QG_CHECKS
composition, verdict semantics (incl. ORCH-047 three-field tester + negative
token priority), reason-strings and worktree->origin/main fallback are 1:1.
The schema validator never influences a gate verdict by default; hard-fail is
reserved behind the frontmatter_validation_strict kill-switch (default False).

New formal handoff spec docs/_standards/HANDOFF_PROTOCOL.md ("stage -> required
output" + required frontmatter schema), aligned 1:1 with PIPELINE_DOCS.md.

Tests: test_frontmatter.py (TC-01..07), test_qg_verdicts.py (TC-08..15),
test_security_gate.py (TC-12), test_stages_invariants.py (TC-16). Full
tests/ green (1212).

Refs: ORCH-076

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/config.py

@@ -553,6 +553,17 @@ class Settings(BaseSettings):
     # ORCH_TRACKER_BRD_REVIEW_CAP_S; default 7200s (2h). 0/negative -> no cap.
     tracker_brd_review_cap_s: int = 7200
 
+    # ORCH-076 (ORCH-52c, FR-2 / D3): kill-switch for STRICT frontmatter-schema
+    # validation. The unified frontmatter contract (src/frontmatter.py) ships a
+    # machine-checkable schema validator (REQUIRED_FIELDS), but by DEFAULT it is
+    # warning-only and never influences any gate's boolean verdict (maybe_warn_schema
+    # is inert). This flag is RESERVED for a future tightening (ORCH-52d, when agents
+    # start emitting the full schema). It MUST stay False in prod / .env.staging —
+    # otherwise ORCH-52c would self-block its own deploy (its docs predate the
+    # schema). Env ORCH_FRONTMATTER_VALIDATION_STRICT; default False (zero behaviour
+    # change). See docs/_standards/HANDOFF_PROTOCOL.md.
+    frontmatter_validation_strict: bool = False
+
     # ORCH-069: QG-0 upper title-length limit (entry gate _qg0_errors). The 80-char
     # cap was a hygiene limit, not structural (slug is cut to [:30] independently,
     # DB title TEXT is unbounded). Configurable via env ORCH_QG0_TITLE_MAX; default