Harden reliable low-token orchestration

[Thibault1818]

Summary

• make exact-commit Git installation lifecycle-free and verify it on macOS/Linux with Node 20/24
• add strict GO/APPLY_AND_GO/REVISE/STOP workflow contracts, bounded Fable usage, independent role profiles, and honest passport handoffs
• add immutable artifacts/passports, restart reservations, session rotation, meaningful merge checks, explicit setup, and fake process-boundary coverage

Verification

• 2,069 tests passed, 2 skipped
• typecheck and production distribution build passed
• runtime audit: 0 vulnerabilities
• package dry run and clean-tree build check passed
• exact-SHA Git install matrix passed on macOS/Linux, Node 20/24
• no real Claude/OpenAI calls or permanent host installation