feat(atlas): Phase B — data-driven /api/atlas.json, CI stage generated from cd.yml

The atlas no longer hand-maintains its content. Authored data lives in one place
(internal/atlas/atlas.json); the Go layer overlays sourced facts and serves the
result at /api/atlas.json; the frontend fetches + renders (inline arrays kept only
as an offline fallback). First generated source: the CI/CD stage's nodes are parsed
from the repo's own .gitea/workflows/cd.yml — so the viz shows the pipeline that
actually runs (guard/check/build/deploy), dropping the aspirational var-go/oath-gate
node that isn't wired yet. That's the point: it can't drift from the real pipeline.

New internal/atlas package (JobsFromWorkflow, Build) built test-first. Adds
gopkg.in/yaml.v3 (justified: parsing the workflow YAML; stdlib has no YAML).

Verified: go build/vet/lint(0)/test green; /api/atlas.json → 9 stages, CI = real
jobs; frontend renders from the fetch (screenshot).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

embed.go

@@ -0,0 +1,12 @@
+// Package cadatlas embeds module-root build artifacts that live outside any
+// subpackage directory. go:embed cannot reach parent directories, so the CI
+// workflow — which the atlas parses to generate its CI/CD stage from the real
+// pipeline — is embedded here at the module root.
+package cadatlas
+
+import _ "embed"
+
+// CDWorkflow is the repo's own Gitea Actions workflow, embedded at build time.
+//
+//go:embed .gitea/workflows/cd.yml
+var CDWorkflow []byte