feat(conventions): substantive work isolates into git worktrees, merge user-ratified

Introduce the worktree convention the corpus previously lacked: any
substantive work stream targeting main — in every mode, autonomous
(/boss) and interactive alike — runs in a git worktree on its own
branch (issue-N-<slug>), and the branch reaches main only through a
user-ratified merge performed by the orchestrator (fast-forward
preferred, push covered by the ratification, no pull request).
Background sessions were already harness-isolated; this extends the
same isolation to the sessions the harness does not guard. The
convention depends on worktree.baseRef=head (the default 'fresh'
bases branches on origin's routinely-stale tip under the
no-autonomous-push discipline), now pinned in conventions.md.

boss/SKILL.md gains the run-level mechanics (§ The run worktree):
one worktree per run named after the reference issue, entered before
the first dispatch; the merge is a user-reserved run-close act; the
done-state notify names the branch as the review handle; closes #N
fires at merge-and-push time. Iron Law, rollback-sandbox framing,
user-reserved-act enumerations, rationalisations, and red flags
updated to match.

Corollary reconciliations after adversarial review: implement's
'there is no branch' narrowed to 'the loop creates no branch of its
own'; specify's auto-signed-commits-on-main heading reworded to
ratified-history framing; the sandbox bullets in conventions.md and
the CLAUDE.md fragment note the anchor is the run branch's base.

The skills meta-repo itself stays exempt (its CLAUDE.md: install
symlinks resolve to the primary clone) and direct-on-main.

specify/SKILL.md

@@ -443,8 +443,8 @@ leaning. This is a *tool it reaches for*, not a gate it must clear: the
 lens returns a finding, the orchestrator decides. Carrier and lenses are
 defined in `agents/spec-skeptic.md`.
 
-**Auto-signed CODE commits on `main` are forward-only — with one `/boss`
-exception.** The spec itself is never a commit (it is a git-ignored
+**Auto-signed CODE commits are forward-only once ratified — with one
+`/boss` exception.** The spec itself is never a commit (it is a git-ignored
 working file), so a later user veto is a forward correction: shell-`rm`
 (or edit) the git-ignored spec, and `git revert` / `git checkout` only
 the downstream **code** it produced. The `/boss` rollback sandbox is the