refactor(governance): retire local agentctl gates for coding flow (U2 closeout)

- AGENTS.md/PROJECT.md rewritten to three-layer model (hard/default/advice);
  remote authority = Gitea native protection, coding flow zero-agentctl
- delete .cursor/rules/agentctl-mandatory.mdc; cursor hooks downgraded to advisory
- CURRENT/FEATURE-MATRIX become read-only snapshots; task state = Issue/PR
- CI: add tracked secrets scan to required go-vet job
- closeout record with V19/V20/V23/V26 evidence
- local pre-commit/reference-transaction hook files removed from main worktree

.github/workflows/ci.yml

@@ -42,6 +42,11 @@ jobs:
       - name: arch-check (block cleared kinds)
         run: ./scripts/arch-check.sh --mode block
 
+      - name: secrets scan (tracked files)
+        run: |
+          bad=$(git ls-files | grep -Ei '(^|/)(\.env|.*\.(pem|key|p12|sqlite|sqlite3))$' || true)
+          if [ -n "$bad" ]; then echo "tracked secret-like files:"; echo "$bad"; exit 1; fi
+
   short-tests-report:
     # 存量已知失败（会话项目绑定等环境依赖用例）在 CI 从未通过；先报告不阻断，
     # 跟踪 issue #2，修绿后并入 go-vet 必需门禁。