PROP-3: durable-at-propose via a bounded push to prop/* refs only

[danielfmonzon]

Implemented through the pipeline. Proposal + full implementation report in docs/proposals/PROP-3-*.md on this branch.

The gap PROP-3 closes. PROP-2 made the proposal durable by committing it at propose time — but only locally. Under protect-main that commit can never reach origin, so a proposal written and never implemented still had no off-machine trace. Demonstrated live during this very run: propose reported committed 540b1cc on main, a commit that is unpushable by construction.

The change.

• propose commits where it is (unchanged), then points prop/{n} at that commit and pushes it — durable on the remote the moment the analysis is made.
• The push target is bounded in code: assert_prop_ref is the single chokepoint and raises UnsafePushTarget for anything outside prop/*, including the traversal case prop/../main that a prefix check alone would accept.
• No PR at propose time. A proposal is an observation, not a request to merge; most should be readable without entering a review queue.
• implement opens the PR once every gate passes — the first moment "please merge this" is meaningful. A red branch stays a branch: pushed as evidence, not queued.
• implement now joins an existing prop/{n} instead of checkout -B resetting it, which would have discarded propose's commit and then failed to push as a non-fast-forward.

The guard test. A recording runner captures every git invocation and executes none. For nine unsafe targets (main, origin/main, ``, prop/, `prop/../main`, `refs/heads/main`, `prop/3:main`, `prop/3 --force`, `propose/3`) it asserts both that `UnsafePushTarget` is raised and that the recorder captured exactly zero invocations — making "before any git call" an observable property rather than a claim about statement ordering a refactor could silently invert.

Also fixed: the no-auto-merge source test now strips docstrings via ast instead of a line/split heuristic. It was flagging the phrase gh pr merge inside a function docstring explaining that no such call exists — a test firing on its own subject's documentation. Re-verified non-vacuous: it still catches both a direct git merge and a gh pr merge --auto.

Gates: ruff PASS, mypy PASS, pytest 691 PASS. Frontend and verify-dist correctly SKIPPED.

Bootstrap note: this run could not open its own PR — implement had already imported the pre-patch module — so this PR was opened by hand. From PROP-4 onward implement opens it. Stacked on #5 (docs).

Merge is human-only; the required CI check must be green first.