Add agentic refresh Phase 0 controls

[juliamuiruri4]

Summary

• initialize and pin GitHub Agentic Workflows authoring support at gh-aw v0.77.5
• add the explicit three-repository capability matrix, source/path allowlists, lifecycle/report/audience/asset/stack contracts, and least-privilege GitHub App policy
• add CODEOWNERS, refresh labels, branch/ruleset templates, action pinning, and deterministic configuration/content validation
• add pull-request checks for strict MkDocs builds and synchronized strict gh-aw compilation

Safety boundary

This change does not add quest agents, discovery schedules, issue creation, content-writing workflows, stack execution, or merge automation. All repositories remain report-only while required capabilities are blocked.

Organization-owner actions required

1. Create and install the organization-owned GitHub App on Azure-Samples/JavaScript-AI-Buildathon only, then configure AGENTIC_REFRESH_APP_ID and AGENTIC_REFRESH_APP_PRIVATE_KEY.
2. Confirm Copilot Code Review AI-credit budget and permission for App-created refresh/** branches.
3. Confirm or create the human-only merge ruleset in repository settings; the user-bypass REST request returned HTTP 404.
4. After this PR merges and both validation checks have successful runs, activate disabled main ruleset 19622585 and the human-only merge ruleset.

The external sample repositories remain report-only pending independent administrator approval.