maintainer: global + per-repo kill-switch

[JSONbored]

An operator (or the contributor running their own miner) needs one unambiguous way to halt ALL autonomous write activity immediately — analogous to the existing review-stack's global kill-switch (AGENT_ACTIONS_PAUSED) but for the miner's own local runtime, plus a per-repo variant so a single misbehaving target can be paused without stopping the whole fleet.

Maintainer-owned: this is the actual trigger surface the Governor consults, and the roadmap treats the kill-switch as core safety-critical infrastructure.

Deliverables

• A global kill-switch (env var or a well-known local config flag, e.g. GITTENSORY_MINER_KILL_SWITCH=true) that the Governor chokepoint checks FIRST, before any other calculator
• A per-repo kill-switch resolvable from .gittensory-miner.yml (MinerGoalSpec) that halts only that repo's queue items while leaving others running
• Kill-switch state changes are themselves recorded to the governor ledger (who/what tripped it, when)
• Tests: global switch denies regardless of per-repo state, per-repo switch denies only its own repo's items, and toggling the switch off resumes exactly where the queue left off (no lost/corrupted in-flight items)

References

• src/settings/agent-execution.ts — the existing review-stack global kill-switch (AGENT_ACTIONS_PAUSED) precedent to mirror conceptually for the miner's own runtime
• The Governor chokepoint (companion maintainer issue) — this kill-switch is one of the inputs it consults first
• .gittensory-miner.yml (new MinerGoalSpec config file, per the architecture skeleton)

[linear-code]

JSO-2438