fix(autofix): publish protected branch repairs through stacked PRs #1199

Problem\n\nThe organization ruleset ContextualWisdomLab ruleset 18156473 now applies PR-only and non-fast-forward protection to all branches in nearly every repository, with no bypass actors. The central review writer still commits and pushes directly to the live pull-request head branch in .github/workflows/pr-review-autofix.yml, and scripts/ci/pr_auto_rebase.py also pushes rewritten heads directly.\n\nObserved 2026-08-21 on ContextualWisdomLab/contextual-orchestrator#765: a normal exact-head push was rejected with GH013 and Changes must be made through a pull request. The compliant manual recovery was a fork-backed stacked PR, ContextualWisdomLab/contextual-orchestrator#810. This means the hourly review loop can inspect and merge, but cannot autonomously publish a correction or rebase under the current writer contract.\n\nThis issue records a control-plane repair. It does not authorize bypass, admin merge, self-approval, force push, fabricated checks, or weakened protection.\n\n## Acceptance criteria\n\n- Central autofix and conflict-repair writers preserve the live original-head guard before any mutation.\n- A direct push is attempted only through the existing normal path. Only the specific PR-only GH013 refusal may switch to a fork-backed stacked pull request targeting the original PR branch.\n- The fallback is idempotent, records the original repository PR and exact head, never prints credentials, and never uses admin or force push.\n- Non-GH013 push failures remain failures and cannot be relabeled as successful publication.\n- The recurring auto-rebase path uses the same protected publication contract or fails closed with an actionable reason.\n- Executable tests cover direct success, exact GH013 fallback, head drift, idempotent reuse, unavailable fork identity, and unrelated push failures.\n- Durable operator documentation explains the protected stacked-PR contract and its security boundary.\n\nReferences: ContextualWisdomLab/contextual-orchestrator#765, ContextualWisdomLab/contextual-orchestrator#810, and #1178.