Add pre-merge rebase and head-bound command checks

[mchwang]

The guarded merge gate in #21 deliberately blocks when the PR base moved or a plan item has a cmd: acceptance check without a passing result tied to the reviewed head. Complete the approved pre-merge sequence once the runner/container execution boundary exists:

• fetch the current base and head;
• rebase through the trusted commit ledger, preserving owned and foreign classifications;
• recompute attribution, choices, and approval staleness after the rewritten head;
• stop for review when any owned fingerprint changed or unresolved foreign/ambiguous work appears;
• run every plan-item cmd: check inside the approved container and persist results against the exact head;
• push, wait for freshly required GitHub checks, rerun the already-fixed check, and hand the exact pair to the guarded merge coordinator.

Acceptance: failing-before/passing-after regressions cover a base move that leaves approvals valid, a rebase that makes an approval stale, a breaking command after rebase, a collaborator head push, and a cancelled or interrupted command.