Repo-level public DWN MVP

[LiranCohen]

Summary

This PR turns the previous broad refactor into a repo-level public MVP for using gitd in place of GitHub's core collaboration surface. It focuses on source, branches, issues, PRs, moderation, local helpers, and passive DWN-backed sync/restore. CI, private repos, org/team inheritance, and public indexer design remain out of scope for this slice.

Key pieces:

• Add repo-level moderator behavior and CLI moderation commands for blocks, locks, hide/unhide/delete comment events, reports, and interaction limits.
• Add contributor branch namespace enforcement: contributors can update and $squash only their own refs/heads/users/<did-hash>/... branches; maintainers/owners retain protected/default branch authority.
• Add branch state and branch bundle records with $squash checkpoints and reducers for deterministic branch convergence.
• Make gitd serve the local helper for CLI/local use, including profile-scoped helper discovery, local-only CLI RPC forwarding, passive DWN sync, and empty-cache restore from DWN records.
• Support git-remote-did clone/fetch through the local DWN helper when the target repo owner is remote and no hosted GitTransport service is needed.
• Add passive standard-DWN test infrastructure and an end-to-end Alice/Bob/Casey public repo flow.
• Document the settled repo-level MVP scope in REPO_LEVEL_MVP_PLAN.md.

Verification

• bun run build
• bun test
  • 1692 pass
  • 8 skipped DID-DHT integration tests
  • 0 fail
  • 7217 expect calls

Notes

The passive-DWN e2e proves the key public repo loop: Alice creates and syncs the repo, Bob clones through his local helper, Bob pushes a contributor branch to Alice's canonical repo via passive-DWN records, Bob opens canonical work items, Casey moderates, Alice merges, and a fresh Bob helper clones the merged repo from DWN records without a hosted authority service holding project keys.