feat: add deterministic operation catalog foundation

[Joncallim]

Summary

Part of #201.

This draft adds the first bounded foundation for Forge's deterministic Operation Catalog:

• a strict, versioned operation request and code-owned catalog;
• three fixed read-only operations: repository status, diff summary, and current branch;
• authoritative task, project, work-package, filesystem-grant, and repository-root checks;
• audited argv-based Git execution with cancellation and deterministic verification;
• a PostgreSQL operation ledger with ordered append-only phase events, idempotent replay, canonical outcomes, and tamper fingerprints;
• ADR 0011 and unit, security-regression, migration, privilege, and hosted PostgreSQL behavior tests.

Safety boundaries

• Model output cannot supply a path, working directory, command, argv, adapter, server, or tool name.
• Repository reads require a current approved/running task and an always_allow filesystem.project.read grant. allow_once fails closed because this slice does not atomically consume it.
• Git diff uses --no-ext-diff --no-textconv; a malicious textconv regression proves repository configuration cannot execute a helper.
• Failed, cancelled, and timed-out commands retain bounded command-audit evidence without copying raw output into the operation ledger.
• This slice does not add writes, arbitrary shell, GitHub/MCP mutation, project-local registrations, autonomy promotion, or retry automation.

Validation

• Full unit suite, including a live-PostgreSQL operation-ledger proof: passing in CI.
• Full ESLint: passed.
• Orthogonal review: no blockers in this draft-foundation scope; advisory findings addressed (best-effort ledger writes, admission-block test coverage, real database error surfaced instead of a generic driver wrapper, PUBLIC-execute revoked on the new trigger functions).
• Migration journal parity: 31 SQL migrations / 31 journal entries; latest 0030_operation_runs.

Stack and follow-ons

This PR previously stacked on draft PR #324, which has since merged; this branch is now retargeted directly onto main.

This PR intentionally does not close #201. Follow-ons before full issue closure include:

• connecting executeTrustedOperation to the normal task/model worker path;
• fenced stale-run lease and recovery;
• independent Workforce verification and autonomy integration;
• MCP-health integration after its dependency chain supports real cancellation;
• stronger filesystem containment before broader reads or any write operation.