feat: add consent-gated social proof workflow

[neonwatty]

Summary

• add an operator-only workflow to review eligible GitHub App owners without persisting another identity list
• store only secret-keyed account fingerprints for contacted, declined, approved, or withdrawn decisions
• export only explicitly approved public profile fields, with authority and evidence safeguards
• fail closed on repository paths, file permissions, mismatched keys, malformed exclusions, and invalid installation records

Privacy boundaries

• no public endpoint and no automatic outreach
• no repository data, usage frequency, issue counts, email addresses, or other enrichment
• all local guards pass before production installation records are read
• stale/reinstalled records are deduplicated and prior decisions survive reinstall without retaining a direct account identifier

Verification

• npm run validate
• 101 test files / 1,563 tests passed
• PR review toolkit: correctness, tests, silent failures, contracts/types, and comments/docs; no remaining findings
• adversarial probes: mismatched key, malformed exclusions, missing/insecure files, duplicate reinstall records, partial initialization, and private-data export leakage