Add secured Codex-Fable-Opus workflow controller

[Thibault1818]

Summary

• add a dedicated, recoverable Codex-Fable-Opus workflow state machine with durable artifacts and compact passports
• enforce bounded Fable usage, isolated Opus worktrees, deterministic reviews, and a commit/diff-pinned fail-closed merge gate
• preserve secured-fork defaults, disable upstream npm publication/update paths, and provide simple workflow CLI commands

Verification

• npm test: 2,075 passed, 2 skipped
• npm run typecheck: passed
• npm run build: passed
• workflow integration: 17/17 passed with deterministic fake adapters
• security regression: 7/7 passed
• npm audit: 0 vulnerabilities
• git diff --check: passed
• pinned GitHub installation and compiled orch workflow --help: verified

No real paid Fable or Opus call was made.

Known limitation

The development host did not have claude or codex installed, so native session-resume syntax was not exercised. The workflow fails clearly in doctor and uses its durable passport/worktree recovery fallback rather than guessing unsupported syntax.

[github-actions]

🎉 Thanks for your first PR to ORCH! We're excited to review your contribution.

Our CI will run automatically:

• ✅ TypeScript strict mode check (tsc --noEmit)
• ✅ Full test suite (1493+ tests via Vitest)
• ✅ ESM build verification

A maintainer will review your changes shortly. In the meantime, check the Contributing Guide to make sure everything is in order.

⭐ If you enjoy working with ORCH, a star on the repo goes a long way!