Initial scaffold: GyanDoot v2.0 in Rust

Full Cargo workspace with 11 crates:
- gyandoot-core: Shared types, config, error types
- gyandoot-agent: Agent loop, tool execution, context compression
- gyandoot-providers: LLM provider abstraction (OpenAI, Anthropic, Ollama)
- gyandoot-memory: MemPalace persistent memory system
- gyandoot-platform: Platform adapters (Telegram, Discord, Webhook, CLI)
- gyandoot-security: Credential vault, sanitizer, threat detector
- gyandoot-kanban: Task decomposition, swarm orchestration, diagnostics
- gyandoot-subagents: Sub-agent spawning and orchestration
- gyandoot-skills: Skills discovery, loading, preprocessing, bundles
- gyandoot-profile: Multi-agent profile manager
- gyandoot-gateway: Gateway sessions, routing, access control

Plus: CLI entry point with clap, cross-platform installer script,
KANBAN.md, .gnpl/AGENTS.md

Workspace compiles clean: cargo check passes with 0 errors.

.gnpl/AGENTS.md

@@ -0,0 +1,40 @@
+# GyanDoot v2.0 — Agent Rules (.gnpl)
+
+## Rule 1: Type Safety First
+All public APIs must use strongly-typed structs, enums, and traits.
+Avoid `Stringly-typed` parameters. Prefer newtypes and enums.
+
+## Rule 2: Error Handling
+All fallible functions return `Result<T, E>` where `E: std::error::Error`.
+Use `thiserror` for library errors, `anyhow` for application-level errors.
+
+## Rule 3: Async Everywhere
+All I/O-bound operations use `tokio` and `async fn`.
+Spawn independent work via `tokio::spawn`. Use channels for coordination.
+
+## Rule 4: Pluggable Architecture
+LLM providers, memory backends, and platform adapters follow the trait-pattern.
+New implementations register via a registry or builder.
+
+## Rule 5: Security
+Credentials are never logged. All secrets stored in encrypted vault.
+User input is sanitized. Shell injection and path traversal are blocked.
+
+## Rule 6: Observability
+All components emit structured logs via `tracing` spans.
+Spans include `agent_id`, `session_id`, `task_id` where applicable.
+
+## Rule 7: Deterministic Builds
+Cargo.lock is committed. No wildcard dependencies in production crates.
+Pin deps in lockfile, use workspace-level version resolution.
+
+## Rule 8: No Hardcoded Paths
+All filesystem paths resolve via `dirs` or `std::env`. No `/root/` or `/tmp/` literals.
+
+## Rule 9: Testing
+Each crate has unit tests. Integration tests live in `tests/` at crate root.
+Never mock what you can control; prefer dependency injection.
+
+## Rule 10: Documentation
+All public items have doc comments. Each crate's `lib.rs` has a module-level doc.
+Examples in doc comments are tested via `#[doc = "```"]`.