…igin String, scope todo rule

Resolve the three real bugs from the Qodo PR review (#2/#3/#4); #1 dismissed as
a false positive with an AGENTS.md clarification.

- #2 FindProjectConfig now returns (string, bool, error): a non-fs.ErrNotExist
  stat failure (e.g. permission denied on an ancestor .skillrig dir) is surfaced
  as fatal instead of masked as "not found"; ResolveOrigin fails fast. Closes
  the discovery-stage gap symmetric to Load's I/O-fatal path.
- #3 Origin.String() returns "" for the zero Origin (the SourceNone sentinel)
  instead of a misleading "/"; precedence test compares directly.
- #4 gitRoot returns (string, error); ProjectWriteTarget falls back to cwd ONLY
  for expected cases (git absent / not a repo) and propagates unexpected errors
  (context cancellation/timeout, exec failures), so init never writes config to
  the wrong directory.
- #1 (markdown checkbox rule violation): false positive — the cited checkboxes
  are /specledger in-document spec/plan checklists, not work tracking. AGENTS.md
  reworded to scope the rule to work-item tracking and explicitly allow them.

Tests (TDD, real fixtures): zero-origin String, permission-denied walk-up fatal,
cancelled-ctx write-target fatal, non-repo cwd fallback preserved. Gate green:
go test ./... · gofmt · go vet · golangci-lint (0 issues).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>