Add machine-checked device-action target matrix

[isomorphisms]

Purpose

Make the device-action requirement in #85 durable and machine-checkable rather than leaving it only in issue prose.

The phone is one implementation environment, not the definition of these actions. Every registered action therefore has independent rows for:

• ARMv7/Thumb-2 on ordinary Linux;
• x86-64 on ordinary Linux;
• Android phone.

Changes

• add examples/device_actions/targets.tsv with 18 actions and all three required profiles;
• keep implementation state, execution state, evidence, next blocker, owner, and Ish/Grease orchestration role separate;
• add a current-directory-independent registry validator under _;
• validate the state vocabulary and reject evidence-free *_pass claims;
• add GitHub-hosted Ubuntu CI that rejects malformed rows, duplicate action/profile pairs, unknown profiles, and missing platform rows;
• point the root AGENTS.md at the canonical device-action matrix so future device work preserves the environment/evidence split.

Current implementation links

• screen_red: Restore ARM/Thumb screen-red oracle on the native development line idric-arm-thumb#64 and Exercise the x86-64 framebuffer-red oracle in CI idric-x86-aggressive-backend#24
• speaker_tone: Add native ARMv7/Thumb speaker-tone oracle idric-arm-thumb#67 and Add native x86-64 speaker-tone oracle idric-x86-aggressive-backend#26

The speaker_tone Linux rows are now oracle_present / ci_pending; Android remains separately unclaimed.

Evidence boundary

This registry does not turn not_started, historical_reference, host execution, user-mode emulation, or simulated devices into runtime acceptance. Full-system virtual-device evidence and physical-device evidence are different states. A handwritten target oracle may pass a guest device test without proving compiler-generated Idriç lowering.

[isomorphisms]

Scope check: this PR records target obligations only. It intentionally does not claim that any not_started, historical reference, simulated device, host execution, or user-mode run satisfies full-system or physical-device acceptance.