feat: materialize declared workspace repositories

[chubes4]

Summary

• add repeatable remote-plus-destination workspace declarations to setup, upgrade, and the setup-profile compiler
• materialize only missing primary checkouts, validate existing checkout roots and origins, and preserve path-only declarations
• persist credential-free clone intent for upgrade recovery while rejecting embedded credentials and unsafe privileged paths
• verify materialized repository origins and document the DMC-free ownership contract

Part of #525 and implements the primary-checkout provisioning portion of #526.

Verification

• bash tests/workspace-materialization.sh
• node tests/setup-profile-compiler.mjs
• bash tests/installation-profile.sh
• bash tests/workspace-installation.sh
• bash tests/verify.sh
• bash tests/convergence-orchestrator.sh
• bash tests/ci-coverage.sh
• shell syntax checks and git diff --check

A broad local shell sweep also reached two unrelated environment-sensitive baseline failures: tests/datamachine-worker.sh renders this machine's absolute Homebrew wp path instead of the bare-path snapshot, and tests/kimaki-install-existing.sh lacks its isolated external credential helper.

AI Assistance

OpenAI GPT-5.6 Sol via OpenCode inspected the existing setup, upgrade, desired-state, runtime, Homeboy, and verification contracts; implemented the change under Chris Huber's direction; exercised the focused test suites; and performed iterative correctness and security review. Chris reviewed and authorized the commit and pull request.