[CTX-0016] chore(workflow): publish CarryCtx snapshots in-repo (retire mirror)

[Xuepoo]

Retire the separate bitty-mcp-workflow mirror and publish CarryCtx snapshots inside this repository on refs/heads/carryctx-snapshots using native carryctx export --publication; restore with native carryctx import --from-git.

Priority: P1 | Area: devtools | Labels: chore,area:devtools,P1 | Milestone: v0.1.0 | RFC: N/A | Task: CTX-0016

Closes #23

What changed

• scripts/workflow-publish.sh (new): carryctx export --pack-format dir -o <tmp> --publication (native redaction + manifest.redacted: true + one commit to refs/heads/carryctx-snapshots), assert the tip is stamped redacted, then git push the branch only when the local ref advanced; no-op message when current. --dry-run writes neither the ref nor the remote.
• scripts/workflow-import.sh (new): fetch refs/heads/carryctx-snapshots, native carryctx import --from-git <ref> --mode replace --yes. Refuses a non-empty local DB (project row with data rows) without --force, --dry-run validates without writing, restores the committed .carryctx/config.toml byte-identically, prints provenance (snapshot commit, export id, CarryCtx-Source). Thin Bash, no Python.
• Removed the mirror pipeline: scripts/publish-ctxpack.sh, scripts/publish-ctxpack-redact.py, scripts/publish-ctxpack-selftest.sh, scripts/fetch-ctxpack.sh, scripts/fetch-ctxpack-selftest.sh.
• justfile: workflow-publish / workflow-publish-dry / workflow-import / workflow-import-dry now call the new scripts.
• README.md (Workflow snapshot restore) and AGENTS.md updated to the in-repo branch.
• .github/workflows/snapshot-source.yml (new): the CI gate.

CI gate design

Snapshot source matches main runs on pushes to main and carryctx-snapshots only, so pull requests and their required checks are unaffected. It fetches origin/main and origin/carryctx-snapshots, extracts the tip's CarryCtx-Source trailer via git log -1 --format=%B <ref>, and fails when the trailer's revision is not a prefix of main HEAD. Before the first publication the branch does not exist and the check passes with a notice. Merge closeout: gh pr merge --squash then just workflow-publish; the snapshot-branch push re-runs the gate green.

Evidence

• bash -n, shfmt -d, shellcheck -S warning clean on both scripts.
• actionlint -color clean; act -n --workflows .github/workflows/snapshot-source.yml succeeds.
• just check green (markdownlint-cli2 0.23.1, Prettier 3.9.6).
• Redaction capability verified locally with carryctx 0.11.1: a real (unpushed) export --publication reports redacted: true and the bundle tree contains zero /home, /mnt, /Users, or workspace host paths.
• Ported from bitty commit bbad681 (CTX-0319); both scripts byte-identical to bitty origin/main.

Notes / residual

• Native carryctx export --publication emits one snapshot per run (each publication records the previous one), so re-running is not content-deduplicated; the push guard only covers a ref that did not advance.
• This PR does not create or push refs/heads/carryctx-snapshots; the merge closeout publishes it and verifies the redacted tree contains no host paths.