fix(push): never push an agent change to .github

[mike-diff]

The protected-path hold ran only before the merge, after ghafk had already pushed the agent's branch. A pushed branch that adds or changes a workflow under .github/ runs in GitHub Actions with the repository's secrets, so a prompt-injected worker or repair could run code with those secrets before any hold or review.

• Before the first push and before a repair push, ghafk lists the files changed against the default branch (--no-renames -z, as the merge hold does). If any is under .github/, it does not push; it parks the issue with the file list and the patch (clipped to 20 000 characters) so the owner can apply it by hand.
• .ghafk/ changes are still pushed and held before the merge, since pushing them runs nothing.
• Tests: a worker that adds a workflow parks and the branch never reaches the remote; an ordinary change still pushes; a repair that adds a workflow is held. Each fails with its hold removed.
• security.md and troubleshooting.md describe the new park.