ci: enforce protected integration workflow

[Pluze]

Why

LabKit previously allowed focused changes directly on main, while CI did not
reject arbitrary PR source branches or multi-step component version jumps.
That left repository policy unable to prevent the already-published App SDK
2.0.1 -> 2.0.3 transition and made the intended delivery path ambiguous.

What changed

• Established repository-owned develop as the permanent ordinary integration
  branch, with bounded hotfix/* branches reserved for production repairs.
• Added a pre-MATLAB policy gate for PR source/repository ownership, App,
  facade, and launcher source-owned version bumps, direct semantic transitions,
  and exact component-history records.
• Keyed Actions concurrency by stable PR number (or push ref) so a newer commit
  cancels obsolete runs from the same delivery stream instead of treating each
  head SHA as an independent group.
• Updated agent, testing, and release guidance; regenerated the tracked
  documentation site.
• Reduced the PR template to review context that GitHub cannot derive: why,
  net change, evidence, and risks/follow-up. It no longer duplicates branch,
  commit, Checks, review, or merge state as task-list checkboxes.
• Left the published release and existing component versions unchanged.

Evidence

python3 -m unittest discover -s .github/scripts -p 'test_*.py'
14 passed

labkittest.run(File="tests/specs/system/repository/TestArchitectureSpec.m")
All 13 identities passed across the focused run and exact-method reruns after
narrowing the new policy assertions to their intended lines.

buildtool docsCheck
374 generated files current

buildtool changedFast
54 passed, 0 failed, 0 errors

GitHub branch protection was verified through the API:

• main: PR required, CI Gate required and strict, administrator enforcement,
  linear history, conversation resolution, no force-push, no deletion.
• develop: normal pushes and main sync merges allowed, no force-push or
  deletion.

Risks and follow-up

• No runtime, saved-data, dependency, scientific, or native-App behavior
  changed. No component version/history record applies.
• No sensitive lab data or local identifying path was added.
• The complete hosted compatibility matrix must pass for the final PR head.
• After squash merge and exact main-push CI, origin/main must be merged back
  into permanent develop before new work starts.

Author confirmation

• The final diff matches the stated scope and contains no unrelated change.
• The evidence above covers required local and manual validation; every
  remaining unverified boundary is explicit.
• The diff contains only synthetic or generic public data, with no private
  App details, lab identifiers, local paths, or recognizable sample values.