Plan the safe README presentation rollout

[szmyty]

Implements the reviewed no-write planning gate for #14. This intentionally does not close the issue or write to consumer repositories.

What changed

• inventory and explicitly classify all 29 visible Ego Hygiene repositories
• redact private repository observation from the public fleet artifact
• pin the exact Hygiene, Identity, merged Holon, and Egolint contracts
• define Mantle, Identity, and Antidote as the three-role canary wave
• report missing Identity packages, canonical facts, and Egolint evidence as blockers
• generate deterministic dry-run plans with exact inventory and plan digests
• require a separate exact-digest review record before proposal generation
• emit at most one credential-free, represented-commit-bound repository proposal
• bind proposals to README blob identity, Egolint evidence, Holon exact preview, supersession, and rollback
• expose privacy-safe adoption, drift, freshness, and exception records to Observatory with no universal health score
• document retry, upgrade, post-merge verification, and rollback behavior

Current fleet finding

The scan found no repository that is safely proposal-ready yet. The three canaries are correctly blocked until each has:

1. a consumer-local immutable Identity package,
2. reviewed repository-owned presentation facts, and
3. a valid report from pinned Egolint revision 4efe92a2609b3384fcf3b5cda343a4f64d108824.

No placeholders are presented as final and no consumer branch or PR has been created.

Authority boundary

This branch has no GitHub client, token input, consumer filesystem writer, or pull-request mutation path. Merging it reviews the inventory/planning mechanism; a later explicit review record and newly eligible inventory are still required before the first canary proposal.

Validation

python3 scripts/plan_repository_presentation.py validate-inventory \
  --inventory "examples/repository-presentation.inventory.json"
python3 scripts/plan_repository_presentation.py plan \
  --inventory "examples/repository-presentation.inventory.json" \
  --output "/tmp/repository-presentation.plan.json"
python3 scripts/plan_repository_presentation.py verify-plan \
  --plan "/tmp/repository-presentation.plan.json"
python3 -m unittest discover \
  --start-directory "tests" \
  --pattern "test_*.py" \
  --verbose

After this is merged and reviewed, #14 continues with unblocking Mantle first, then independent canary proposals.