Harden runtime identity handling and repository hygiene

[wocha]

Summary

• removes hardcoded Git identity from the runtime image and wrapper
• passes Git identity via runtime-only Git config env instead of writing .git/config
• makes --doctor read-only with respect to mounted repositories
• adds MIT license and removes obsolete legacy wrapper
• documents Git trust boundaries around writable mounted repositories
• adds ShellCheck and Podman build smoke checks to CI

Validation

• bash -n scripts/*
• shellcheck -x scripts/*
• podman build -t codexcli-runtime-final-smoke .
• scratch-repo --doctor test: .git/config unchanged before/after
• git diff --check