checkpoint: multi-repo Gitea ingestion, per-project repos, rotation anchor_sha fix

Pre-existing uncommitted work found at session start: rotation now emits
anchor_sha on TaskReleased (previously silently dropped by store.Append
validation), multi-repo Gitea provider support, per-project git worktree
roots, and associated test coverage. Committing as a checkpoint before
starting remediation work tracked in AUDIT.md.

internal/authz/authz.go

@@ -17,6 +17,13 @@ const (
 	Web      Surface = "web"
 	MCP      Surface = "mcp"
 	Maven    Surface = "maven"
+	// System identifies the plane itself — the router, coordinator, provider
+	// adapters, and lease-expiry reclaim. Per invariant 2 ("the plane emits
+	// events, not the agent"), these are the only non-surface emitters and are
+	// always full control. Every event must carry an explicit Surface; there
+	// is no unauthenticated default, so an emitter that forgets to declare one
+	// is rejected at the bus rather than silently treated as trusted.
+	System Surface = "system"
 )
 
 type Capability int
@@ -33,7 +40,7 @@ func CapabilityFor(s Surface) Capability {
 	switch s {
 	case Telegram, Ntfy:
 		return NotifyOnly
-	case TUI, Web:
+	case TUI, Web, System:
 		return FullControl
 	case MCP, Maven:
 		return GatedWrite