ci: add protected quality debt ratchet

[rylinjames]

Code fix for #291. The issue must remain open until the protected environment and required check are configured and proven on a real PR.

What changed

• computes Ruff check/format and mypy findings independently from protected base and PR head using protected judge/config
• rejects new stable fingerprints while allowing debt removal and bounded line relocation
• runs untrusted candidate validation without status authority or shared executable state
• adds a protected manual policy-update workflow with exact candidate/base/run artifact binding
• rechecks live main, PR base/head, exact sole environment reviewer, workflow provenance, and immutable evidence before status publication
• forbids mypy plugins and ordinary-PR policy/judge/workflow changes without exact-SHA protected approval

Validation

• final independent review: APPROVE after six security rounds
• 14 focused/adversarial tests pass
• Ruff check/format, mypy, workflow YAML, compilation, and diff checks pass
• full same-SHA ratchet: 2007 → 2007, zero new findings

Post-merge admin setup (required before closing #291)

1. Create quality-ratchet-policy environment, protected branches only, sole reviewer rylinjames.
2. Require quality-ratchet/protected on main.
3. Validate a real PR and protected policy-update run.

No repository settings or workflows were executed by this change.

[rylinjames]

Independent review: APPROVE. The protected/untrusted workflow split, immutable SHA and artifact binding, live branch revalidation, sole-reviewer policy check, analyzer restrictions, and zero-new-debt gate were re-audited after six remediation rounds. All 7 required checks are green.