Add clean-origin docs verification receipts

[marcusglee11]

Summary

• Adds scripts/wiki/post_merge_verification_receipt.py to fetch current origin/main, verify from a detached clean worktree, and emit the required post-merge receipt shape.
• Records verified commit, commands/results, dirty-worktree state, follow-up issue URLs, and failure classifications (new_drift, baseline_noise, tooling_failure).
• Redacts common token/secret patterns from command summaries before receipt serialization.

Closes #121

Test plan

• python3 -m pytest -q tests_doc/test_post_merge_verification_receipt.py
• git diff --check
• python3 scripts/workflow/quality_gate.py check --scope changed --json (blocking gates pass; local mypy unavailable advisory)
• python3 scripts/wiki/post_merge_verification_receipt.py --json (expected exit 1 on current origin/main; stale wiki provenance classified as new_drift, dirty flag false)
• Fresh-context blocker review: no blockers after redaction patch

🤖 Generated with Claude Code

[marcusglee11]

Hermes Review — PR #133

Verdict: approved for merge after CI returns green on head cec3e645ce272e18c4cd15dff09f23e0b3554b6e.

Scope check:

• 2 files changed, 366 net additions before review fix; still narrow to receipt helper + focused tests.
• No protected governance/state docs changed.
• closingIssuesReferences correctly targets #121 only.

Review actions taken:

• Found and fixed two review-hardening issues before approval: shell execution for operator-supplied command strings, and under-tested redaction coverage.
• Follow-up commit cec3e64 removes shell=True, uses shlex.split, removes unused dataclass code, broadens redaction for bearer/private-key/token-like output, and strengthens the redaction test with a valid token-shaped sample.

Local verification after review fix:

• python3 -m pytest -q tests_doc/test_post_merge_verification_receipt.py → 5 passed
• git diff --check → pass
• python3 scripts/workflow/quality_gate.py check --scope changed --json → pass; local mypy unavailable advisory only
• python3 scripts/wiki/post_merge_verification_receipt.py --json → expected exit 1 against current origin/main, correctly classifies stale wiki provenance as new_drift, dirty worktree false

Fresh-context review:

• Earlier blocker-only review found secret leakage risk; patched.
• Second blocker-only review found no remaining blockers.

Remaining boundary:

• Do not merge until the new CI run for cec3e645ce272e18c4cd15dff09f23e0b3554b6e completes green.