Add reduced demo implementer workflow

[rainerhahnekamp]

Summary

• add an opt-in readiness → worktree → no-goal Codex → pull-request demo workflow
• keep the production goal, deterministic-check, snapshot, and review path unchanged
• label demo evidence and pull requests with their reduced assurance boundary
• authenticate GitHub App installation tokens correctly for HTTPS Git operations

Verification

• pnpm typecheck
• pnpm test (33 tests)
• live readiness evaluation against the configured local model
• organization GitHub App token issuance and authenticated MacroQuest fetch

Demo activation

The ignored local .env selects IMPLEMENTER_WORKFLOW=demo and targets Soverius-AI/angular-a2ui-macroquest.