feat(workflows): add the reusable repository journal

[szmyty]

Summary

This draft starts the single bounded implementation line for Relay's reusable repository journal.

Step 1 establishes the runtime and authentication preflight:

• checksum-lock @github/copilot@1.0.85 and its npm graph for Node.js 24
• prefer the short-lived workflow GITHUB_TOKEN with copilot-requests: write
• define an explicit, non-automatic fine-grained PAT fallback
• emit a closed, secret-free, fail-closed preflight result
• bound agent attempts, timeout, scheduled frequency, and billing ownership
• validate runtime drift in Relay's canonical CI

The live organization-policy/account check remains intentionally pending so it can be completed with the repository owner. This draft does not invoke Copilot, change organization settings, persist credentials, check out consumer code, or advance later journal stages.

Published Step 1 implementation: f94eb4f8360e34963953417fadc3919d3a106ae7

Validation

• 368 unit and integration tests
• 12 focused repository-journal runtime tests
• 11 actions, 18 workflows, and 13 reusable workflows validated
• continuity-contract validation
• Python compilation
• 57 JSON and 31 YAML documents parsed
• exact installed CLI reports GitHub Copilot CLI 1.0.85
• git diff --check

Advances #15
Advances #95