Retire schema guard from package workspace contract (#148)

[fitz123]

Summary

Stacked on #151 / issue-148-package-cli-workspace-contract.

This follow-up completes the corrected #148 architecture:

• treats --workspace as the control/app workspace;
• allows absolute agents.*.workspaceCwd outside the control workspace;
• retires schema/write-guard package contract (schema.md, MINIME_SCHEMA_PATH, Pi guard extension, Claude guard hooks);
• keeps Telegram/Discord/Tavily as control-workspace/global secrets;
• passes non-secret control path refs to Pi parent/cron/subagent children;
• keeps Tavily on dedicated control-root config/secrets.sops.yaml + tavily.api_key;
• adds deterministic schema/guard contract removal check and private cleanup artifact.

Validation

Ralphex reported:

• git diff --check
• npm run typecheck
• npm run check:schema-guard-contract
• npm run validate-config
• npm test — 1434 pass, 0 fail
• npm run build
• npm run workspace:validate -- --workspace ./test-fixtures/minimal-workspace
• npm pack --dry-run

Notes

• Do not merge before Prepare package CLI and workspace contract #151 settles/merges.
• Do not merge without explicit Ninja approval.

[fitz123]

Superseded by #153. This PR was accidentally marked merged when the stacked base branch was briefly advanced to the cleanup head; the base branch has been restored to #151 head (6ece37c), and #153 is the active stacked PR for this change.