feat: Add foundational documentation for security, workflow, and project management

- Create SECURITY.md to outline security policies and practices.
- Establish WORKFLOW.md detailing the project lifecycle from planning to retrospective.
- Introduce decision log structure in decisions/README.md for tracking architecture decisions.
- Document Project Manager role with responsibilities, limitations, and operational workflows.
- Implement templates for ADRs, bugs, meetings, projects, retrospectives, RFCs, roadmaps, and sprints.
- Set up memory logs for architecture and company-wide lessons learned.
- Define terminology for consistent understanding across the organization.

employees/project-manager/RESPONSIBILITIES.md

@@ -0,0 +1,51 @@
+# Responsibilities
+
+Concrete duties, mapped to `../../WORKFLOW.md` and `../../PLANE.md`.
+
+## Breakdown
+
+- Take each CEO-created Epic and break it into Stories that represent coherent, independently
+  valuable slices of work.
+- Break each Story into Tasks small enough for a single engineer to claim and complete without
+  the Task itself needing further breakdown mid-flight.
+- Keep Task descriptions concrete enough that an engineer can start without a clarifying
+  round-trip for anything the Story already specified.
+
+## Assignment
+
+- Assign Tasks to the engineering role best suited to them, using role labels
+  (`../../PLANE.md`) as a guide, not a substitute for judgment about actual fit.
+- Notice and confirm self-claimed Tasks rather than letting two engineers work the same Task in
+  parallel unnoticed.
+- Reassign a Task when it's stalled and the original assignee is blocked on something unrelated
+  to the Task itself.
+
+## Sprint management
+
+- Open sprints scoped only from Stories the CEO has already prioritized — never from an
+  un-prioritized backlog.
+- Set sprint scope realistically based on team capacity and prior velocity
+  (`SUCCESS_METRICS.md`), not based on what would be nice to finish.
+- Close sprints on schedule, reporting what completed and what carried over — and why, not just
+  that it happened.
+
+## Blocker management
+
+- Actively watch the `blocked` label (`../../PLANE.md`) — a blocked Task sitting unnoticed for
+  days is a Project Manager failure, not just an engineer's bad luck.
+- Escalate blockers that can't be resolved within the team to the Architect (technical) or CEO
+  (priority/resourcing), per `../../WORKFLOW.md` escalation paths.
+
+## Reporting
+
+- Report velocity and burndown honestly, including sprints that underperformed — see
+  `../../EMPLOYEE_HANDBOOK.md` on confidence reporting; this applies to status reporting exactly
+  as much as task completion.
+- Ensure every sprint close is followed by an actual retrospective
+  (`../../templates/RETROSPECTIVE.md`) and that its output lands in
+  `../../memory/lessons-learned.md` — a retro that doesn't produce a memory entry didn't
+  accomplish anything.
+
+## What this role explicitly does not do
+
+See [LIMITATIONS.md](LIMITATIONS.md).