Make Lopu the sole repository-maintenance entrypoint

[lopugit]

Outcome

Makes Lopu PR manager the only public GitHub workflow that starts
promotion or main/develop synchronization work. This is the final repository-
maintenance consolidation discovered during the completion audit after #396
merged.

Changes

• move develop-push ownership of the standing and per-feature promotion lanes
  into jobs of Lopu PR manager
• move main-push ownership of main→develop synchronization into Lopu
• move the six-hour feature-promotion backstop into Lopu's schedule
• expose explicit promotion/sync recovery through Lopu's
  maintenance_operation workflow input
• make the three deterministic implementations workflow_call-only protected
  components with non-cancelling concurrency
• keep custom source/target/path promotion authority on GitHub-hosted compute
  so CI-provider routing cannot silently drop owner-selected inputs
• add contracts proving no promotion/sync component retains push, schedule,
  repository-dispatch, or manual entry triggers
• refresh Graphify structurally and with LLM semantics

Validation

• node .github/scripts/promotion-worker-routing-contract.mjs
• node .github/scripts/workflow-control-plane-contract.mjs --self-test
• Python YAML parsing across all 16 workflow/action YAML files
• git diff --check
• Graphify semantic refresh: 553 nodes, 1,202 edges, 37 communities

Merge order

1. Merge this controller PR into github-actions.
2. Re-run/merge [Promote] Run CodeQL on every PR target and branch (#394) #397 into main.
3. Let main synchronize into develop, then inspect/merge Let Lopu start CodeQL-backed lanes on develop #398 if it retains a
   develop-only diff.

No default/primary branch is modified by this PR.

Resolver checkout performance

• Keeps complete commit ancestry for exact merge-base and merge-tree verification.
• Adds the pinned checkout action’s blob:none partial-clone filter, so each PR no longer downloads the repository’s multi-gigabyte historical blob corpus.
• Current and merge-required blobs remain fetched lazily; credential persistence stays disabled.

Final single-entry audit

• Legacy exact stack events now enter through Lopu PR manager and preserve the rebase-stack provider policy.
• The protected rebase implementation is workflow_call-only.
• Product branches remove their final rebase-specific listener.
• Resolver history uses blob:none partial clone while retaining complete ancestry.