Add clean-origin verification receipt

[marcusglee11]

Summary

• Adds scripts/clean_origin_post_merge_receipt.py to verify from freshly fetched origin/main in a detached clean worktree.
• Emits a redacted machine-readable receipt with verified commit, command results, dirty-worktree status, follow-up issue URLs, and failure classification.
• Adds focused regression coverage for redaction, clean-origin readback, drift classification, and shell=True absence.

Test plan

• pytest tests_doc/test_clean_origin_post_merge_receipt.py -q
• python3 scripts/workflow/quality_gate.py check --scope changed --changed-file scripts/clean_origin_post_merge_receipt.py --changed-file tests_doc/test_clean_origin_post_merge_receipt.py --json (mypy unavailable locally; advisory only)
• python3 -m py_compile scripts/clean_origin_post_merge_receipt.py && git diff --check
• live smoke: python3 scripts/clean_origin_post_merge_receipt.py --command 'python3 -m doc_steward.cli wiki-lint .' --command 'python3 scripts/workflow/quality_gate.py check --scope changed --json' --summary-limit 300 (correctly classified existing wiki drift as new_drift / follow_up_required)

Closes #121