checkpoint: multi-repo Gitea ingestion, per-project repos, rotation anchor_sha fix

Pre-existing uncommitted work found at session start: rotation now emits
anchor_sha on TaskReleased (previously silently dropped by store.Append
validation), multi-repo Gitea provider support, per-project git worktree
roots, and associated test coverage. Committing as a checkpoint before
starting remediation work tracked in AUDIT.md.

deploy/orchestra.service

@@ -6,16 +6,20 @@ Wants=network-online.target
 [Service]
 Type=simple
 User=orchestra
+Group=orchestra
 WorkingDirectory=/var/lib/orchestra
-Environment=ORCHESTRA_DATA=/var/lib/orchestra/data
-Environment=ORCHESTRA_PORT=9145
+EnvironmentFile=/etc/orchestra/orchestra.env
 ExecStart=/usr/local/bin/orchestra
 Restart=on-failure
 RestartSec=5s
 NoNewPrivileges=true
 ProtectSystem=strict
-ReadWritePaths=/var/lib/orchestra
+ProtectHome=true
 PrivateTmp=true
+ReadWritePaths=/var/lib/orchestra
+# ORCHESTRA_WORKTREE_ROOT / per-project worktree_root paths and
+# ORCHESTRA_REPO must live under one of these, or under /var/lib/orchestra —
+# add further ReadWritePaths= lines here if you keep repos elsewhere.
 
 [Install]
 WantedBy=multi-user.target