Merge dev → main (automated) - #2125

`refs/worklog/data` carries commits from two legitimate environments
(operator + agent store), but the author-identity gate runs in strict mode
here because this repo's `config.defaults.yaml` is the project template and
declares no `syncAllowedAuthors`. Every agent sync was therefore refused
unless `--allow-foreign-author` was passed.

Declare a narrow allow-list in `.worklog/config.yaml` (project-local, so the
identities never leak into projects created from the template) and add a
contract test that drives the real config merge and the real gate: listed
authors accepted, unknown author refused, empty author refused even with the
allow-all override, and no config.yaml shadowing of defaults.

Full-suite note: tests/unit/persist-write-detection.test.ts was already red on
dev before this change (9 failures, introduced by 0d8324d); triaged as
WL-0MVM9E3SV003III0.

…ntract tests

…-list (WL-0MVMZP6A5005PB66)

…w host signals and rate-based event-loop headroom

…ll pacing

…racted worktree module

…cannot blow its budget

The dispatch-parity test spawns one CLI process per built-in command (~32).
Serially that cost multiplies by the command count: at load ~30 each
--help took ~10 s and the sum exceeded the test's fixed 300 s budget with
nothing wrong in the code (WL-0MVSFQ3J4004SNJ9).

Run the parity loop through a bounded pool (4 in flight, mapConcurrent +
an async spawn wrapper) so the wall cost stays near one spawn, and raise
the budget to 600 s. Verified the guard still fails when a command is not
dispatchable.

Also commit the npm-normalised packages/herdr/package-lock.json metadata
(hasInstallScript/bin): scripts/install-herdr.sh runs 'npm ci --prefix
<main checkout>/packages/herdr' on every build, which rewrote that tracked
file and tripped the run_tests live-repo-mutation guard.

…orktree churn

…al exception)

…nd reproduction