feat: scaffold CODEOWNERS and AWS OIDC example in cascade init

[joshua-temple]

Problem

cascade init already scaffolds a starter manifest plus build/deploy callback stubs and self-checks them through the real generator, but issue #4's acceptance list also calls for a starter .github/CODEOWNERS and an AWS OIDC role example, and the verifying-starter property (init then generate leaves verify clean) was never proven in a test.

Fix

• internal/scaffold: every scaffold now also emits .github/CODEOWNERS (catch-all review rule with a placeholder team) and .github/aws-oidc-role.example.json (an IAM trust-policy example for GitHub Actions OIDC, matching the documented configure-aws-credentials role-to-assume format, with placeholder account/org/repo). Both shapes (release-only and multi-env) get both files. Content is static and deterministic.
• New integration test internal/initcmd/verify_clean_test.go: runs the real init into a temp dir for the no-env and four-env shapes, generates the planned workflows the way generate-workflow does, then asserts verify.Run returns nil (no drift, no orphans). This is the verifying-starter proof.
• Unit tests for presence, valid JSON, determinism, and a guardrail scan of scaffolded content.
• Docs: cli-reference init section and README quick-start note the new files and the verifying-starter property.

Verification

• go build ./cmd/... ./internal/...: OK
• go test ./...: green except the documented local-only TestNormalizeWorkflowPath_ActionlintClean flake in internal/generate (actionlint resolves reusable-workflow paths against the real repo root; untouched by this change, passes in CI).
• golangci-lint run ./...: 0 issues.

Closes #4.