Tier-2: protected branches + deploy keysVerified

Protected branches: per-repo rules (exact / prefix-glob / *) that block
direct pushes (force PRs; admins may override) and/or require signed
commits. Enforced at push time in pre-receive (run-checks) before any
check runs, reading ref updates from stdin once.

Deploy keys: per-repo SSH keys (read-only by default, opt-in write) for
CI/deploy without a user account. authorized_keys gets `d<id>` lines so
git-shell routes them to a repo-scoped auth path; keys re-synced on add
/delete. Settings UI gains Protected Branches and Deploy Keys sections.

Also wire repo CI secrets into the runner gRPC FetchTask path
(secrets_env) to complete Tier-1 #3 across the runner agent.

Migration 61: cave_protected_branches, cave_deploy_keys.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>