chore(loop): make the branch ruleset the gate, not the GitHub credential

[Alex1990]

Rebased onto main after #45 merged; the five commits here are the whole diff.

Read #45 first if you have not. It is merged and carries the endpoint-level evidence
for the facts this PR builds on (merging lives under Contents, a PR needs a head
branch). Its conclusion — that the loop's safety should be expressed by splitting
credentials — is what this PR replaces, and main currently contains that superseded
wording until this merges.

The property, and where it now lives

Nothing reaches main without a human. Earlier commits on this branch tried to enforce that with credentials — a PAT for the host, a read-only job token for the agent. That does not work, and the reasons are worth stating because they are the whole design:

• A PAT acts as its owner, who is this repository's only admin and therefore the ruleset's bypass actor. A loop holding one can merge an unapproved PR.
• PRs opened with a PAT are authored by the owner, whom GitHub forbids approving their own work — so the loop's output would be simultaneously un-approvable and unapproved-mergeable.
• The agent can read the host's environment (/proc/<ppid>/environ), measured, so "the child does not inherit the token" was never containment.

Repository configuration settles it instead, so no credential has to:

Main branch (ruleset 21855851, target ~DEFAULT_BRANCH, enforcement: active)
  rules:          deletion · non_fast_forward · pull_request(required_approving_review_count: 1)
  bypass_actors:  User(owner), bypass_mode: pull_request

actor	push to main	merge without an approval
the owner	refused	allowed (bypass) — merging is the consent
the loop (github.token)	refused — not a bypass actor	refused — and it cannot approve its own PR

bypass_mode: pull_request is the load-bearing choice: it lets the owner merge their own PR (solo repo — self-approval is forbidden) while refusing every direct push, including the owner's. permissions: cannot grant administration, so the loop cannot weaken the rule that bounds it.

Measured, not asserted — an idempotent PATCH /git/refs/heads/main returns:

422 Repository rule violations found
    Changes must be made through a pull request.

and on Actions the job token's POST /rulesets returns 403.

Consequences, all deliberate

• GH_TOKEN is now just github.token. No PAT exists anywhere in the loop; agentEnv strips only the R2 keys. The host still owns every write, but as a division of labour (one place to enforce the branch/PR-marker rules), not as a permission boundary — if the agent wrote to GitHub itself, main would still be refused.
• Job permissions rise to contents/issues/pull-requests: write, because the loop needs them for real. The ruleset, not the scope list, is what bounds them.
• The loop can no longer change .github/workflows/**: the job token has no workflows permission and permissions: has no key that grants one. Such tasks route to a human; applyActions recognises the rejection and says so instead of retrying. A PAT would push them and bring back the bypass — a real trade, resolved in favour of the gate.
• gh-check.mjs is no longer a scope report. It asserts, in order of importance: main is un-writable; the loop cannot edit the ruleset; and the loop can still read and do its own writes. Non-zero exit when either of the first two fails, so it can gate a switchover.
• The agent prompt states the boundary the platform enforces rather than a 403 the agent would no longer receive.

Implementation beyond the ruleset

pr-opened plans push → pr-create → label/comment, executed by the host from the agent's result.json, with the PR number recorded in task.prs. Fail-closed checks, in order of cost:

• validatePush (entry.mjs): an unbacked pr-opened — branch outside loop/<taskId>-<slug>, another task's number, empty title, or writeLevel=report — is downgraded to failed, so a task cannot wait in waiting-merge for a PR nobody opened.
• applyActions: pushes nothing but loop/<issueNo>-<slug>; refuses a dirty tree (the commit would stay behind and the PR would ship an incomplete diff); aborts the chain after a failed push/PR creation; and explains a workflow-file rejection rather than retrying it.
• finishRun: runs the push and PR creation before recording the outcome, so failure lands the task in the inbox rather than waiting-merge.
• ensureLoopPrBody: repairs the Closes #<n> / loop-task: #<n> markers the router pairs with the branch — a missing marker would make the loop's own PR look external: no acceptance row, and its merge would close the task by the wrong path.

Verification

Local (four throwaway harnesses, green): agentEnv; applyActions push + every refusal incl. the workflow-file message; finishRun's push → PR #4242 → label path; entry.mjs end to end with a stub engine (branch really lands; bad branch name, another task's number, report boundary and missing credential all fail closed).

On Actions (run from this branch, so the new permissions: apply):

[loop:gh] MAIN PROTECTION — the property that matters:
  active rules on main: deletion, non_fast_forward, pull_request
  refused  direct push to main (idempotent; writes back the SHA it read) (HTTP 422)
[loop:gh] CAN THE LOOP EDIT ITS OWN GATE (administration)?
  refused  create a ruleset (HTTP 403)
  present  Issues: write / Pull requests: write / Contents: write
  ABSENT   Actions: write (403) / Secrets access
[loop:gh] OK: `main` requires a reviewed pull request, the loop cannot edit that rule,
          and the loop's own writes work.

pnpm lint, pnpm fmt:check and node --check on every touched module are clean (the 39 lint warnings are pre-existing).

What this PR does not claim

The GitHub auto path has still never run on Actions. The ruleset and the scope probes are verified live; the write path (push → pr-create → label) is verified locally only. First auto run is the thing to watch.

Human setup

The ruleset half is already applied (and was verified by the probes above). Remaining:

1. Set repository variable LOOP_EXECUTE_WRITES=true when you want the loop to write.
2. Delete the LOOP_GH_TOKEN secret — nothing references it any more, and a PAT there is the one configuration that could defeat the gate.

Do not merge without review; this is host machinery (AGENTS.md: the loop is maker or checker, never both).

[github-actions]

Coverage

Metric	%	Covered / Total
Lines	90.19%	1003/1112
Statements	89.06%	1083/1216
Functions	91.03%	193/212
Branches	76.43%	519/679