Add secure shared context workflows

[Swarek]

Outcome

Context Room now supports generic shared documentation and skills with a secure Git workflow:

• agents edit only scoped proposal/* worktrees
• humans review the exact proposal commit and can keep only selected hunks
• accepted output is rebased onto the latest main and published as accepted/*
• Context Room never pushes the shared default branch
• secure-github installs a no-bypass pull-request ruleset plus a repository-specific writable deploy key for agent Git operations
• security-check verifies both remote rules and the local restricted credential
• connected projects consume immutable read-only snapshots and global/project skill links

Verification

• npm test: 204/204 passing
• context-room doctor --root .: OK
• focused acceptance tests prove main remains unchanged while the selected result exists on accepted/*
• GitHub ruleset and deploy-key setup are covered with a deterministic fake API test
• live Peerlab setup verified every rule and credential check