maintainer: dry-run-by-default enforcement

[JSONbored]

A freshly-configured miner MUST default to dry-run (observe/log only, never actually execute a write) until a contributor explicitly opts into live writes — mirroring the review-stack's deny-by-default autonomy floor (observe, src/settings/autonomy.ts) and its dry_run action mode (src/settings/agent-execution.ts). This issue wires that default into the Governor chokepoint itself, not just documentation.

Maintainer-owned: an incorrectly-defaulted-to-live miner is exactly the failure mode the roadmap flags as the top strategic risk.

Deliverables

• The Governor chokepoint defaults to dry-run when no explicit live-mode opt-in is present in .gittensory-miner.yml or local config — absence of config means dry-run, not live
• Dry-run mode logs the WOULD-BE action (full LocalWriteActionSpec) to the governor ledger with a distinct dry_run decision type, without ever invoking the actual command
• A single, explicit, hard-to-fat-finger opt-in path to live mode (not a generic boolean flag that could be accidentally true) — require an explicit string literal match, not truthy coercion
• Tests: no config ⇒ dry-run, malformed/partial config ⇒ dry-run (fail closed), and only the exact opt-in value flips to live

References

• src/settings/agent-execution.ts (AgentActionMode, "safest wins" precedence: paused > dry_run > live) — the exact mode vocabulary and defaulting logic to mirror
• src/settings/autonomy.ts (DEFAULT_AUTONOMY_LEVEL = "observe") — the deny-by-default precedent this issue extends to the miner's own runtime
• The Governor chokepoint (companion maintainer issue) — this default is one of its first checks

[linear-code]

JSO-2439