docs(roadmap): cross-link milestones to issue backlog and dependency waves

[BunsDev]

What

Closes the gap between the GitHub tracker and the repo's canonical ROADMAP.md. Contributors reading the repo now see the same milestone → issue → dependency structure that's live in the issue tracker.

Changes (doc-only)

• Milestone bullets → issue numbers. Every M1–M5 bullet is annotated with its tracked issue (Add durable task queue and GitHub delivery idempotency #2–Publish security, isolation, self-hosting, hosted-vs-self-hosted, and familiar contract docs #24). M1 marked shipped (closed backfill Implement issue assignment, label, mention, and PR review comment triggers #20–Publish security, isolation, self-hosting, hosted-vs-self-hosted, and familiar contract docs #24).
• Filled two omissions. The M2 milestone on GitHub includes auth split (Split agent read auth from publication write auth #4) and the hosted memory governance contract (Define hosted memory governance contract between coven-github and coven-code #6); the roadmap was missing both. Added.
• New "Build Sequence & Dependencies" section. Mirrors the native GitHub "blocked by" DAG and topological waves from sequencing tracker Backlog sequencing: dependency DAG and build order (moat → hosted V1) #25:
  • Critical path: #2 → #4 → #10 → #13 → #19
  • Waves 0–4, with Add durable task queue and GitHub delivery idempotency #2 as the single foundation chokepoint (all four hosted paid gates Add hosted worker container isolation and resource limits #5/Add tenant-scoped task API authentication for CovenCave and hosted clients #3/Add installation-scoped familiar routing and repository policy #7/Define hosted memory governance contract between coven-github and coven-code #6 sit ≤2 hops from it).

Notes

• No code paths touched. Whitespace clean (git diff --check).
• Dependency edges referenced here are already applied as native GitHub relationships; see Backlog sequencing: dependency DAG and build order (moat → hosted V1) #25.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates ROADMAP.md to better mirror the live GitHub issue tracker by cross-linking roadmap bullets to their tracking issues and documenting the sequencing/dependency structure used to plan milestone delivery.

Changes:

• Annotated Milestone 1–5 bullets with their associated GitHub issue numbers and marked Milestone 1 as shipped (closed backfill #20–#24).
• Added two missing Milestone 2 items present in the tracker (auth split #4 and hosted memory governance contract #6).
• Added a new “Build Sequence & Dependencies” section summarizing the critical path and topological build waves from sequencing tracker #25.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.