governance: add protected-edit block approvals

[br4vesirrobin]

Summary

• cascade the protected-edit block approval contract from r3dlex/rib-workspace#83
• keep individual approval recommended and agent configuration individual-only
• bind optional block approval to the exact ticket, current Git HEAD, entry count, and canonical manifest SHA-256
• store audit records only in fixed worktree Git metadata with fail-closed symlink, hard-link, FIFO, and alias protections
• wire the shared regression suite into this repository's AI-SDLC validator

Validation

• 17 protected-edit regression tests passed
• repository AI-SDLC validator passed
• git diff --check passed
• architect, code reviewer, and executor gates approved exact shared hashes
• no application/, C#, project file, Entity Framework, or EF Core changes

Dependency

The root governance PR r3dlex/rib-workspace#83 is merged.