Make the solo-founder readiness model honest and deterministic

[dorkalev]

Intent

Align the reusable Shadow starter with an exactly-one-human company, eliminate model spend from required/daily paths, enforce a main-only protected change flow, protect the evidence archive, reconcile all live required checks, and deploy immutable image digests.

Acceptance criteria

• AI/CI identities are never represented as independent people or approvers.
• Daily verification and required merge gates make zero LLM calls by default.
• Normal changes target protected main; archive history blocks force/deletion.
• Required checks are read from both rulesets and classic protection and fail closed.
• Reusable workflows pin third-party actions.
• Tests, shell validation, and Terraform formatting pass.