fix(autofix): publish protected branch repairs through stacked PRs

[seonghobae]

Problem\n\nThe organization ruleset ContextualWisdomLab ruleset 18156473 now applies PR-only and non-fast-forward protection to all branches in nearly every repository, with no bypass actors. The central review writer still commits and pushes directly to the live pull-request head branch in .github/workflows/pr-review-autofix.yml, and scripts/ci/pr_auto_rebase.py also pushes rewritten heads directly.\n\nObserved 2026-08-21 on ContextualWisdomLab/contextual-orchestrator#765: a normal exact-head push was rejected with GH013 and Changes must be made through a pull request. The compliant manual recovery was a fork-backed stacked PR, ContextualWisdomLab/contextual-orchestrator#810. This means the hourly review loop can inspect and merge, but cannot autonomously publish a correction or rebase under the current writer contract.\n\nThis issue records a control-plane repair. It does not authorize bypass, admin merge, self-approval, force push, fabricated checks, or weakened protection.\n\n## Acceptance criteria\n\n- Central autofix and conflict-repair writers preserve the live original-head guard before any mutation.\n- A direct push is attempted only through the existing normal path. Only the specific PR-only GH013 refusal may switch to a fork-backed stacked pull request targeting the original PR branch.\n- The fallback is idempotent, records the original repository PR and exact head, never prints credentials, and never uses admin or force push.\n- Non-GH013 push failures remain failures and cannot be relabeled as successful publication.\n- The recurring auto-rebase path uses the same protected publication contract or fails closed with an actionable reason.\n- Executable tests cover direct success, exact GH013 fallback, head drift, idempotent reuse, unavailable fork identity, and unrelated push failures.\n- Durable operator documentation explains the protected stacked-PR contract and its security boundary.\n\nReferences: ContextualWisdomLab/contextual-orchestrator#765, ContextualWisdomLab/contextual-orchestrator#810, and #1178.

[seonghobae]

Codex /root began the protected writer repair at 2026-08-21 21:42 KST. Scope is limited to the shared publication boundary and executable control-plane tests; live head guards and normal protected merge gates remain authoritative.

[seonghobae]

Implementation published as #1202 at exact head cc241e7a8d0538828e0b0fc24071b192c72e0a7f. Local gates: 1,331 tests plus 16 subtests, 100% statement/branch coverage, 100% docstring coverage, actionlint, Strix quick gate, py_compile, diff check, and healthy CodeGraph index.

[seonghobae]

Resolved by the live organization ruleset reconciliation tracked in #1200/#1176: proposal refs are no longer governed as default branches, do_not_enforce_on_create is enabled, and ordinary same-repository proposal-branch updates have succeeded without bypass. PR #1202 was closed because its fork-backed writer is no longer the minimal repair; #1200 remains the audit-as-code follow-up.