feat: Centralize CAO policy in versioned JSON

[mnkiefer]

• Previously, policy was fragmented across repository variables, workflow defaults, dispatch inputs, and a separate target YAML document. That created ambiguous precedence, configuration drift, limited review history, and policy changes that were not atomic with workflow changes.
• This PR makes .github/central-agentic-ops.json the sole authority for persistent, non-secret Central Agentic Ops policy:
  • Adds a strict, dependency-free Node.js policy resolver.
  • Removes policy reads and fallbacks from CENTRAL_AGENTIC_OPS_* Actions variables.
  • Resolves control policy at the exact github.workflow_sha.
  • Resolves live target authority from the target’s exact default-branch SHA.
  • Uses static package, role, and worker identities in workflows.
  • Applies native noop behavior when packages or workers are disabled or undeclared.
  • Migrates Dashboard and Ops Publish to the same resolved policy.
  • Updates documentation, package guidance, tests, and generated lock files.
  • Removes the legacy YAML authority format and orphaned workflow artifacts.

No longer needed