feat(M5): Final hardening, CI surface, and documentation closeout

CHANGELOG.md

@@ -5,6 +5,83 @@ Entries are milestone-scoped; stories within each milestone are listed for trace
 
 ---
 
+## M5 — Final hardening, CI surface, and documentation closeout
+
+### What changed in M5
+
+**S-501 — CI workflow added**
+
+`.github/workflows/check.yml` runs on every push and pull request against a
+matrix of `ubuntu-latest` and `macos-latest`. Each job:
+
+1. Installs `shellcheck` (apt on Ubuntu, brew on macOS).
+2. Installs `ripgrep` (apt on Ubuntu; pre-installed on macOS runners).
+3. Installs Node.js 22 and pnpm 10.
+4. Runs `pnpm install --frozen-lockfile`.
+5. Runs `pnpm run check` (full quality suite, offline link-checking).
+
+`.github/workflows/check-online.yml` runs `verify:docs:online` on a weekly
+schedule (Monday 09:00 UTC) and on manual `workflow_dispatch`. This keeps
+external link checking out of the push/PR critical path.
+
+**S-502 — Root README contributing section**
+
+`README.md` now includes a "Contributing / Development" section that names
+`pnpm run check` as the single quality gate, lists prerequisites, and links
+to `docs/DEVELOPMENT.md`.
+
+**S-503 — `docs/DEVELOPMENT.md` finalised**
+
+Added:
+
+- **"Adding a new agent variant"** recipe (6 steps from canonical source to CI).
+- **"Adding a new skill"** recipe (6 steps).
+- **"CI"** section describing both workflows and how to add new prerequisites.
+- **Permanent `check` contract** replacing the transitional M1 wording.
+- Cross-reference links to `.github/workflows/check.yml` and
+  `.github/workflows/check-online.yml`.
+
+**S-504 — Baseline report closed**
+
+`docs/CLEANUP-BASELINE.md` updated with a "Final state" section showing every
+baseline failure resolved, a baseline status summary table, and the
+post-M5 `pnpm run check` output.  The document is now closed.
+
+**S-505 — `package.json` file list synced**
+
+`docs/DEVELOPMENT.md` and `docs/REVIEWERS.md` added to the `files` array.
+All listed entries verified to exist in the post-M5 tree.
+
+**S-506 — Changelog extended (this entry)**
+
+**S-507 — Final green run confirmed**
+
+`pnpm run check` exits 0 on macOS 15 (arm64) with Node 22.14.0 and
+pnpm 10.18.1.  CI workflow exercises the same gate on both `ubuntu-latest`
+and `macos-latest`.
+
+### `pnpm run check` status after M5
+
+```text
+PASS  lint
+PASS  typecheck
+PASS  test
+PASS  verify:pi
+PASS  verify:reviewers
+PASS  verify:docs
+PASS  verify:generated
+```
+
+All checks green. CI enforces this on every push and PR.
+
+---
+
+## M4 — Shared-abstraction extraction and dead-code removal
+
+*See `docs/CLEANUP-BASELINE.md` § "Post-M4 state" for the full M4 delta.*
+
+---
+
 ## M3 — Shared-source generator for agent variants
 
 ### Package metadata change ⚠️