feat: add P0 open-work and publication safety

[Wibias]

Summary

• add a read-only repository-scoped open-work status workflow with deterministic work-item reference resolution
• preserve PR-body media by default, including reference-style Markdown images and legacy GitHub uploads, and require exact authority-bound removal identities
• prevent duplicate PR publication for an existing exact head/base while preserving owned idempotent retries
• bind duplicate/idempotency checks and actual PR creation to the exact head repository, including head_repo for explicit cross-repository sources
• preserve repository identity for linked GitHub issues and reject unsafe external display URLs
• wire the workflow through routing, mutation-mode, controller-profile, policy, docs, and routing-eval contracts

Hardening found during self-review

• reject blank PR heads and inconsistent head / headRepo identities
• qualify REST head filters so same-repo idempotency lookups do not silently miss matches
• bind PR idempotency receipts to the exact source repository
• prevent cross-repository closing issues from masquerading as same-repository work items
• protect full, collapsed, and shortcut reference-style Markdown images from accidental body rewrites
• fix weak open-work URL fixtures so PR-number normalisation is actually tested

Validation

• focused regression contracts were added for every hardening item above
• repository-wide local npm run check is intentionally not claimed from this environment; remaining executable-suite failures will be handled from the user's local run
• GitHub Actions status is not used as the gate for this work because the current Actions allowance is exhausted

Review notes

• approvedMediaRemovals is deliberately part of the trusted update_pr_body authority scope; changing the exception list changes the scope hash
• duplicate prevention is exact head-repository + head-ref + base-ref matching, not title/fuzzy matching
• owned exact idempotency retries are resolved before the broader duplicate preflight so safe retries still converge
• open-work status remains lightweight and read-only; named-PR deep readiness stays in references/status.md

Limitations

• P1 tracker enrichment/writes are intentionally excluded; external work-item keys are displayed without inventing Linear/Jira URLs
• the repository-wide README examples still need the normal local/full-file edit path; this connector is not being used to risk a destructive whole-file README rewrite