Add repository restore rehearsal guard

[zergzorg]

/claim #10

Summary

• add a distinct repository restore rehearsal guard for Project Repository & Version Control
• validate release snapshots for restore drill recency, protected refs, semantic tag coverage, component hashes, LFS/restricted artifact mirrors, environment locks, notebook replay evidence, and export manifest linkage
• emit deterministic release/remediation queues, audit digest, JSON/Markdown/SVG reviewer artifacts, and an H.264 demo video

Non-overlap

This slice focuses on restore rehearsal readiness before DOI/export publication. It does not implement the broad repository ledger, release engine, rollback UI, legal hold, embargo, access review, dependency licensing, sensitive-artifact scanning, branch hypothesis lineage, or component-owner approval quorum slices already visible on issue #10.

Safety

• synthetic fixtures only in repository-restore-rehearsal-guard/sample-data.js
• no private repository scans, credentials, payment data, external APIs, network calls, or real user data

Validation

• npm run check
• npm test
• npm run demo
• ffprobe -v error -select_streams v:0 -show_entries stream=codec_name,width,height,duration,avg_frame_rate -show_entries format=size,duration -of default=noprint_wrappers=1 repository-restore-rehearsal-guard/reports/demo.mp4 -> H.264, 960x540, 5 seconds, 15 fps, 5,227 bytes
• git diff --check
• git diff --cached --check
• rg -n "(api[_-]?key|secret|token|password|wallet|paypal|stripe|private key|BEGIN RSA|BEGIN OPENSSH)" repository-restore-rehearsal-guard || true -> no matches

Demo video: repository-restore-rehearsal-guard/reports/demo.mp4