Limit Evergreen to schedule and manual dispatch

[mrjf]

Summary

• remove the default-branch push trigger from Evergreen
• keep Evergreen activation to schedule and workflow_dispatch
• update repo policy to say main changes are handled by scheduled reconciliation or manual dispatch
• raise Evergreen safe-output patch budget from the compiled default 1KB to the gh-aw maximum 10KB
• add a gate-clearing repair loop for lint/typecheck so one run can fix multiple mechanical diagnostics from the same failing command
• recompile the Evergreen workflow lockfile

Why

A merge to main woke Evergreen immediately via the default-branch push path. For TSB, that is too noisy; scheduled reconciliation is enough by default, with manual dispatch for urgent cases.

Evergreen also needs enough write budget and instruction to clear a failing lint/typecheck gate in one coherent repair instead of pushing tiny symptom commits.

Validation

• gh aw compile evergreen --dir .github/workflows --validate --strict --approve --no-check-update
• gh aw lint --dir .github/workflows