docs: volition, planning, agency and cognitive research

New documents define goal, want, intention, commitment, plan, action,
capability, authority, agency and introspection operationally, state
prominently that no operational measure establishes phenomenal
consciousness or sentience, and describe the rules, thresholds, events,
inspection points and limits of each subsystem:

- docs/volition.md: want derivation, reinforcement, decay and suppression,
  conflicts, formation and its outcomes, the intention–action gap,
  reconsideration, commitments and volition metacognition;
- docs/planning.md: plans and step kinds, validation, strategies, the
  executor, observe–act–verify, replanning, budgets, operator attention,
  long-running work, restarts and duplicates;
- docs/agency.md: the fifteen authority invariants and their tests,
  scoped authority, forensic why, attribution and the agency timeline;
- docs/cognitive-research.md: operational definitions separating
  implementation property from philosophical interpretation, experiment
  protocols (global workspace, ablation, self-model, counterfactual, model
  comparison, conflict), every measure, introspection accuracy,
  metacognitive calibration and temporal self-continuity.

Updated: interpretation table, capabilities (metadata, typed operations,
scoped grants, requests), cognition, snapshots (fork authority), security
and threat model (T14, T16, new T27–T29), architecture, README, changelog,
release notes, ADR-0012 and ADR-0013, and PLAN.md §8.10 status. The
unimplemented record_procedure internal step is removed from the
vocabulary; procedural memory is recorded when a plan completes.

docs/RELEASE_NOTES.md

@@ -20,6 +20,10 @@ Second release: every phase of the plan is implemented, tested and documented, a
 
 The review pass recorded in PLAN.md §7 and summarised in [epistemics.md](epistemics.md), plus the Amazon Bedrock provider, are the 0.2.0 section of the changelog. Its remaining limitations are listed at the end of that document.
 
+## After 0.2.0 (unreleased)
+
+Volition, planning and cognitive research are in the [Unreleased] section of the changelog and PLAN.md §8. govulncheck reports one module-level advisory (GO-2026-5932, `golang.org/x/crypto/openpgp`, no fix available) in a package Noema does not import; no reachable vulnerability is reported.
+
 ## Known limits
 
 - Replays diverge honestly when retrieval scoring depends on wall-clock recency; a virtual clock for replay is future work.