Add a Forge-native pre-push repository validation gate

[eshulman2]

Summary

• add a centralized repository-change validation boundary to both Forge Git push paths
• validate against the trusted origin/merge base before publication
• reject protected exact/glob paths, unsafe symlinks, oversized changes, malformed Git metadata, and missing base references
• return a typed successful validation result and convert rejected publication into the existing GitError boundary
• provide a composable OutputValidator interface used by Scan agent-derived code and text for secrets before publication #77 and future deterministic checks

Forge architecture

This PR intentionally stays at the GitOperations publication boundary. It does not add sandbox artifact-transfer policy or intercept Jira/GitHub clients.

Test plan

• 11 focused repository-validation and GitOperations tests pass
• Ruff passes on changed implementation and tests

Closes #263

Follow-up: #77