Rustabaka

Stub-first admin shell extracted from the turbo foundation. This surface is intentionally thin: role wiring, webhook ingress, and typed orchestration boundaries are in place, while workspace-backed agent execution remains deferred.