Add audited branch adjudication command

[andrei-hasna]

Summary

Adds a narrow audited branch-row adjudication surface for the Infinity relocation gate:

• repos registry adjudicate-branches --spec <json> dry-run/apply command
• SDK export adjudicateBranches
• v11 branch_adjudication_audit table
• exact guarded row checks for is_remote=1 -> is_remote=0
• exact evidence refs via git check-ref-format + git show-ref --verify --hash
• commit-prefix disambiguation before accepting abbreviated stored SHAs
• reviewed plan hash + idempotency key requirement for apply

This PR does not mutate the live Repos registry and does not run relocate-primary --apply.

Verification

• bun run typecheck
• bun test src/db/branch-adjudication.test.ts src/db/primary-relocation.test.ts src/db/database.test.ts — 110 pass / 0 fail
• bun run build
• staged gitleaks protect --staged --source <worktree> — no leaks
• range gitleaks detect --source <worktree> --log-opts origin/main..HEAD — no leaks
• copied-DB integration with real Infinity 14-row spec:
  • adjudication dry-run on copied DB: ok, 14 rows, plan 5d11c14f7514842eaeac241b906fd7b607d6bfcf3f9e4173f9aac24329a2cf0e
  • adjudication apply on copied DB: ok, 14 rows
  • post-adjudication copied-DB relocation dry-runs: accounts/sandboxes/codewith/infinity all can_apply=true, blocks 0

Safety notes

• Live DB was not changed.
• No relocation apply was run.
• The operation requires a reviewed dry-run plan hash before apply.
• Rows are updated only by exact row id/repo id/name/current is_remote/stored commit guards.
• Evidence refs must be exact branch refs and resolve to an unambiguous stored commit.