Scope 1: Harden autonomous guardrails token preflight and auth mapping

[svelderrainruiz]

Summary

• require WORKFLOW_BOT_TOKEN preflight for branch-protection and release-guardrails workflows
• remove github.token fallback on those workflows for deterministic auth behavior
• classify branch-protection query failures into authentication vs authorization reason codes
• add remediation_hints to guardrails self-healing report for deterministic operator actions
• update docs and workflow contract tests

Validation

• Invoke-Pester -Path ./tests -CI (233 passed, 0 failed)
• Invoke-Pester -Path ./tests/BranchProtectionDriftWorkflowContract.Tests.ps1,./tests/ReleaseGuardrailsAutoRemediationWorkflowContract.Tests.ps1,./tests/ScopeAOpsRunbookContract.Tests.ps1 -CI