Enforce repository I/O security boundary

[alicankiraz1]

What changed

• makes RepositoryIO v1 the mandatory repository evidence and planner-write boundary
• adds a loader-bound, descriptor-held controller launcher and skill-root authority
• hardens secret scanning, CAS/atomic writes, extracted-package admission, and controller trust-store isolation
• updates planner/apply guidance and README/usage/maintenance truth
• adds regression coverage for PP-READ-002, PP-WRITE-003, PP-SECRET-005, scanner complexity, launcher substitution, package parity, and explicit-only $codexqb activation

Why

PR2 closes repository read/write and model-evidence bypasses without granting host attestation, VERIFIED, or finalization authority.

Validation

• make check-fast — 431 passed
• make check-unit — 462 passed, 1 platform-specific skip
• make check-schema — 11 passed
• make check-behavior — 243 passed
• make check-platform — 35 passed on macOS
• make check-package — passed
• make check-public-privacy — passed with 0 new findings and 70 known hash-only baseline matches
• git diff --check — passed
• real controller trust-store guard — unchanged

make check-release remains intentionally blocked because the 70-entry history baseline cannot be empty until the separately approved history rewrite.