feat: add shared bot registry and named project roles

[KeepSilenceQP]

Summary

• move Bot Registry data from source defaults into installation-level Root Config with safe lifecycle and CLI management
• switch /project bootstrap to explicit plan-writer and implementer role flags with live identity resolution
• add migration, rollback, runtime acceptance, package privacy gates, and closeout evidence
• complete the separately authorized source-branch history remediation for the protected denylist

Verification

• pnpm ci:local: 144 files, 1484 passed, 33 skipped; typecheck and build passed
• protected tree, dist, and exact tarball: 10 patterns, 0 findings; same tarball clean-installed
• GitHub CI run 30219308559: package smoke, Ubuntu, macOS, and Windows passed
• post-rewrite fresh fetch of all 5 source branches: complete history scan 0 findings and git fsck clean

Scope boundary

Old PR refs, tags, releases, caches, and GitHub Support remediation were explicitly excluded from the narrowed history-rewrite authorization.