v0.2.2 — wizard URL + public repo user-autonomy

User-autonomy fixes from first real-world test feedback.

Fixed

• Wizard step 6 (GitHub backup) over-validated URLs:
  • Now accepts both SSH (git@github.com:user/repo) and HTTPS
  • Empty input is now allowed → defer URL to ai-bootstrap backup init later
  • User no longer locked into giving a URL at wizard time
• backup init refused public repos outright:
  • Now warns + asks for explicit confirmation instead of hard-blocking
  • Rationale: user autonomy — the user knows their threat model

Why

In v0.2.1 test, the wizard rejected a valid SSH URL and refused to proceed.
Two design errors: (1) regex was https-only, (2) URL was mandatory if user
said "yes" to backup. Both fixed.