feat(git-identity): announce confirmed mismatches at session start

[verlyn13]

Summary

Adds the source-side Q1b SessionStart identity announcer for Claude Code and Codex while
retaining the existing PreToolUse identity enforcement as the mutation backstop.

The announcer emits a fixed privacy-safe warning only for a confirmed Git-identity mismatch
and otherwise fails silently. It does not claim that live SessionStart registration or
dispatch is already active.

Scope

• add git-identity-sessionstart
• add callable machine evaluation to git-identity-gate without changing legacy CLI behavior
• extend the focused identity suite
• document the source/runtime ownership and activation boundary
• include the focused suite in repository validation
• update ng-doctor for the new managed target

No live Claude or Codex configuration is changed by this PR.

Validation

• focused Q1b suite: 114/114 passed before commit
• classified differential:
  • accepted_controls=2
  • contract_rejected=80
  • checker_error=1
  • conservative_consumer_only=2
  • producer_rejected_machine_confirmed=0
• repository validation passed at an actual 80-column PTY
• GitHub push-triggered Repo Validation passed on exact head
  d55cd1519a66dfd41e77c82f06273b1e1d40a0d7

Activation remains pending

After landing, Q1b still requires separate owner-controlled steps:

1. deploy the exact managed gate, announcer, and doctor targets;
2. verify deployed bytes/rendered output against landed source;
3. append the settled SessionStart command separately to Claude and Codex without disturbing
   existing handlers;
4. complete Codex trust review;
5. remeasure installed and active hook inventories;
6. require positive wrong-root warnings and separately verify correct-root silence;
7. reverify the existing PreToolUse mutation backstop.

Registration alone is not dispatch proof, and correct-root silence is not positive-path
acceptance.

Deliberately out of scope

• the pre-existing PTY-width test-isolation defect;
• the stale .github/PULL_REQUEST_TEMPLATE.md;
• unrelated 1Password documentation work in the main checkout;
• any general agentic-configuration cleanup.