Story (A+D): strip AGENTS/impl-plan sanction + enroll all shims in fleet byte-identity drift [petry-projects/.github#604] #1079

Part of the shim-identity epic combsmith/.github#604 — Story A + D in .github-private (sanction removal + fleet byte-identity enrollment).

A — remove sanctioning language (petry-projects/.github-private)

• AGENTS.md — delete "Repo-specific trigger adjustments may be made to dev-lead.yml per the stub's header comment."
• docs/dev-lead/implementation-plan.md (~line 543) — remove the same "may be modified on PR branches to adjust triggers for repo-specific needs" header text from the documented template.

D — enroll every shim in tier-normalized byte-identity fleet drift

• scripts/fleet_monitor.sh STUB_REGISTRY — add dev-lead.yml, pr-review-mention.yml, and the RING shims (auto-rebase, dependency-audit, dependabot-automerge, dependabot-rebase, agent-shield) alongside the existing initiative stubs.
• scripts/fleet_stub_drift.sh — make the "expected" content tier-normalized: compare each repo's stub against the canonical template repinned to that repo's ring tier (ring_canonical_ref), not a single canonical blob SHA, so per-tier channel pins are not false-positives. (Requires ring-pins.sh availability to the monitor.)
• Tests in tests/fleet_stub_drift.bats for the tier-normalized cases (same-tier aligned, higher-tier accepted, trimmed on: → drifted).

Acceptance

• Fleet monitor reports full-file drift for dev-lead + pr-review-mention + RING shims, respecting per-tier channel pins.
• Running it against the current fleet surfaces the known fragmentation (only broodminder-export converged) — this report drives the consumer re-syncs (Story E, filed after this lands).