Harden pair workflow state and publication guards

[Oleg-Melnik]

Summary

Harden the two-agent workflow so review state remains bound to the exact shared
checkout and pull-request publication fails closed when repository, remote, or
target state changes unexpectedly.

Changes

• Pin effective Git configuration, remote identity, target lineage, branch
  publication inputs, and engine settings for each run.
• Add repository-wide locking, between-turn checkout digests, Git Trace2
  provenance, NUL-safe changeset snapshots, and failed-turn poisoning.
• Harden publication against remote branch collisions, target rewrites or
  absorption, implicit tags and hooks, scratch-file staging, and post-review
  edits.
• Update the pair-workflow protocol, template, run guide, and regression
  coverage for the hardened behavior.
• Bump the Chords version and regenerate the POM and dependency reports.