Add Forge sensitive summary guardrails

[im-sham]

Summary

• add summary-only validation for Forge core incident free-text fields
• preserve existing pointer ref and observed_state mapping guards while expanding obvious raw/sensitive key coverage
• surface validation failures cleanly through CLI and MCP logging
• document the G100B summary/ref-only contract in README and CONTRACTS

Verification

• .venv/bin/pytest tests/test_cli.py tests/test_mcp_http.py tests/test_models.py -q -> 40 passed
• .venv/bin/ruff check forge_cli tests -> All checks passed
• git diff --check -> passed

Boundary

Forge remains incident-memory and failure-pattern truth only. This PR does not add workflow truth, Governance approval/redaction/export truth, source payload storage, training approval, policy-learning approval, production automation approval, tenant metadata, or audit maturity.