Enforce execution-agent provenance at integration

Why: Implementation changes must be mechanically tied to a successful CLI transport instead of relying on agents to follow prose.

Evidence: Admission tests went RED without apply/admit; 10 admission, 41 agent-exec, and 62 task tests now pass with exact staged-content matching.

Impact: Adds validated transport fast-forwarding and rejects unproven implementation commits while exempting task cards and approved plan/spec paths.

Refs: feature/agent-cli-enforcement

scripts/hooks/pre-commit

@@ -10,4 +10,5 @@ echo "$branch" | grep -qE '^(feature|fix|hotfix|release)/[A-Za-z0-9._-]+$' || {
   echo "pre-commit: 拒绝——分支名须为 feature|fix|hotfix|release/<slug>，当前：${branch}" >&2
   exit 1
 }
-exit 0
+root=$(git rev-parse --show-toplevel)
+PYTHONDONTWRITEBYTECODE=1 python3 "$root/scripts/agent_exec.py" admit --repo "$root"