feat(governance): add CTO session completion protocol, TBC charter, and process governance OpenSpec change

- CLAUDE.md + README.md: new CTO Session Completion Protocol (authorized/done vocabulary, end-of-session summary requirement)
- docs/engineering/08-workflow.md: Section 8 — CTO Session Completion Protocol
- scripts/start-cto.sh: startup protocol updated to read PRD.md first
- openspec/changes/process-governance-handoff-gap/: full OpenSpec change record (proposal, design, specs, tasks)
- TBC/charter.md: Technical & Business Consultant charter
- TBC/minutes/TBC-MIN-001-2026-04-07.md: inaugural TBC meeting minutes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/engineering/08-workflow.md

@@ -370,3 +370,60 @@ Adds docs/engineering/ with 11 documents covering architecture,
 service deep-dives, code walkthroughs, dev setup, workflow,
 testing, deployment, and SDK guide.
 ```
+
+---
+
+## 8. CTO Session Completion Protocol
+
+This section applies to the Virtual CTO role. It defines the required communication protocol at the end of any session that involves CEO-authorized actions.
+
+### 8.1 Completion Confirmation (Required)
+
+After the CEO authorizes any action via `#vpe-cto-approvals`, the CTO MUST:
+
+1. Execute the authorized action
+2. Post a **completion confirmation** to `#vpe-cto-approvals` before closing the session
+
+The confirmation message MUST include:
+
+| Field | Description |
+|-------|-------------|
+| Action completed | What was done |
+| Outcome | Success or failure |
+| Commit hash | Required if the action involved a git commit |
+| Resulting state | What state the system/repo is in now |
+
+> Authorization and completion are two distinct, required messages. An authorization alone does not constitute completion.
+
+### 8.2 End-of-Session Summary (Required)
+
+Before closing any session that contains completed, pending, or in-progress work, the CTO MUST post a structured summary to `#vpe-cto-approvals`:
+
+```
+## End-of-Session Summary
+
+### Completed This Session
+- <action> — <commit hash or outcome>
+
+### Pending (Authorized but Not Yet Executed)
+- <action> — authorized in msg #<id>, not yet executed
+
+### Requires CEO Action Next Session
+- <decision or approval needed>
+```
+
+If nothing is pending and all actions are complete, a brief "session complete, nothing pending" message is sufficient.
+
+### 8.3 Authorized vs. Done Vocabulary
+
+These two terms have precise, non-interchangeable meanings:
+
+| Term | Meaning |
+|------|---------|
+| **Authorized** | CEO has granted permission. Action has NOT been executed. |
+| **Committed / Completed / Deployed** | Action has been executed and confirmed with evidence. |
+
+Rules:
+- Never use "completed" or "committed" to describe an action that has only been approved
+- Always include supporting evidence when claiming completion (e.g., commit hash, test output)
+- If no commit hash exists for a git action, the action is not done — regardless of authorization status