[Reliability] Add a cross-workflow branch writer lease with fencing

[seonghobae]

Problem

The repository has per-workflow concurrency groups, invocation artifact claims, live-head checks, and compare-and-swap guards, but no shared durable writer lease across merge scheduler, autofix, auto-rebase, and other branch-mutating workflows. Different concurrency namespaces can select the same repository/branch concurrently; a final head guard limits damage but does not provide ownership, TTL, heartbeat, fencing, or recoverable handoff.

Required contract

The source-write ownership key is (repository, branch). One actor holds it at a time; read-only fleet audit never obtains it. Lease ownership does not imply review, merge, release, or deployment authority.

Acceptance criteria

• ADR-0001 is implemented with an owner, generation/fencing token, acquisition time, TTL, heartbeat/renewal, and explicit release/takeover state.
• Every branch-mutating workflow acquires the same lease key before checkout/mutation and revalidates the live head before push/merge.
• A stale or superseded holder cannot publish a mutation after a newer generation wins.
• Lease storage and credentials are least privilege and auditable.
• Tests cover two workflow types racing, lost heartbeat, runner death, delayed stale writer, handoff, different branches, and read-only audit.
• Rollback leaves expected-head and ruleset protection intact.
• Protected-main consumer evidence demonstrates contention and recovery without source loss.