Enforce repository-only authority for Boatstack runs

[bigboateng]

Summary

• deny external resource deletion, lifecycle weakening, and public exposure through shell and MCP safety hooks
• add a fail-closed repository-only authority receipt for managed runs
• distinguish HOOK_GUARDED from CREDENTIAL_ENFORCED in structured preflight output
• require issuer keys from an operator-protected external trust store so managed agents cannot self-author authority
• update generated distribution documentation, configuration schema, and release notes

Safety boundary

Hooks remain defense in depth and block known unsafe command families without an in-session override. CREDENTIAL_ENFORCED is reported only when a short-lived signed receipt matches the repository, worktree, host session, principal, authority class, issuer, and expiry. Missing, stale, forged, mismatched, overprivileged, or agent-authored trust inputs fail closed.

Deployment, destructive recovery, public exposure, and cloud administration remain outside managed agent sessions.

Verification

• go test ./...
• go vet ./...
• go build ./...
• python3 -m unittest tests.test_product_loop
• generated public distribution: 404 files match source
• generated distribution go test ./...
• release-note validation and commit-based preflight
• exact incident-command, wrapper, whitespace, environment-prefix, shell, indirect, MCP, receipt-binding, and trust-store refusal tests