feat: harden release governance and workflows

[tbitcs]

Summary

• add epistemic chat condensation, portable agent and Zoo-Code handoffs, and Git-safe session events
• default new projects to a governed single-branch workflow until another strategy is explicitly selected
• harden Windows launcher guidance, ESDB Git policy, CI/release workflows, docs, and security checks
• resolve CodeQL findings and add regression coverage for Windows launcher shadowing and dev-version recovery

Verification

• 2240 passed, 8 skipped, 5 xfailed (full suite before final focused follow-ups)
• 32 passed for issues Windows PATH shadowing can leave multiple specsmith installs active after pipx install/upgrade #286 through Make ESDB session persistence branch-safe and Git-mergeable #290
• ruff, mypy, strict MkDocs, pip-audit, and Specsmith audit all pass locally

Closes

Fixes #286
Fixes #287
Fixes #288
Fixes #289
Fixes #290