feat(framework): P1+P2 — public sanitization + blocking CI gate

Adds tools/quality/scripts/verify-sanitized.sh (two-class, self-tested) wired
blocking in .woodpecker/ci.yml; sanitizes operator identity from the public
framework package so the gate is green.

- purge jarvis/jason/woltje/PDA across 26 files -> generic
- delete jarvis-loop.json overlay; add neutral examples/{personas,overlays}
- relocate maintainer AUDIT to docs/audits/; delete 2 jarvis-brain rule blocks
- neutralize SOUL persona; strip "(Policy: Jason ...)" keeping universal rule
- test fixtures jason.woltje -> ci-bot (both git tests pass)

Deferred (tracked): private third-party host (uscllc) genericization.

Refs #542, closes #571

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/mosaic/framework/tools/git/test-gitea-login-resolution.sh

@@ -39,7 +39,7 @@ if [[ "$*" == "login list --output json" ]]; then
     cat <<'JSON'
 [
   {"name":"evil-usc","url":"https://evilgit.uscllc.com","user":"bad.actor"},
-  {"name":"usc","url":"https://git.uscllc.com","user":"jason.woltje"}
+  {"name":"usc","url":"https://git.uscllc.com","user":"ci-bot"}
 ]
 JSON
     exit 0
@@ -263,8 +263,8 @@ set -euo pipefail
 if [[ "$*" == "login list --output json" ]]; then
     cat <<'JSON'
 [
-  {"name":"mosaicstack","url":"https://git.mosaicstack.dev","user":"jason.woltje"},
-  {"name":"usc","url":"https://git.uscllc.com","user":"jason.woltje"}
+  {"name":"mosaicstack","url":"https://git.mosaicstack.dev","user":"ci-bot"},
+  {"name":"usc","url":"https://git.uscllc.com","user":"ci-bot"}
 ]
 JSON
     exit 0