source-control: dossier branches per owning item #7579

Parent

Refs #7555. Source: PLAN Phase 12, topic poteto-review. Thread: Dossier branches.

Depends on

• config-cascade: settings resolution and convention home #7571 Settings resolution and convention home (prefix setting)
• work-items: bug path, triage clusters, claim protocol, trackers and morning brief #7578 work-items (tracker binding)

Outcome

Each owning work item can keep its docs, exploration notes and draft plan on a dossier/<key>-<slug>
branch, pushed only after a pre-push secrets and machine-data check, and deleted when the item
closes.

Decisions

• Per-item dossier/<key>-<slug> branch with the tracker's own key; prefix a setting, default
  dossier/ (repo); one dossier per owning item (a parent or spec container gets its own, children
  add their own only when needed); holds docs, exploration notes and the draft plan until finalized;
  deleted on close; pre-push secrets and machine-data check (Q533, Q573, Q168). Origin: owner's
  (the name) and ours.
• The pre-push secrets check is this thread's first item: CI runs gitleaks on PRs only, and a dossier
  branch is pushed with no PR.
• Rejected: one ephemeral context branch per issue ("context" is overloaded, D70); workfiles and
  other work-compounds (Q573); findings in the resolution comment instead of a branch (Q533).
• No ruleset applies to the prefix today (Q533).

Key interfaces

From the design's contracts, "Settings": "Dossier branch prefix dossier/, repo; branch shape
dossier/<key>-<slug> with the tracker's own key; one per owning item; deleted on close."
Variation verdicts: "Dossier prefix: contain now; setting default dossier/; abstract-now not chosen
(Q573)."

Done when

• The source-control convention and /work-items:work both name the dossier/ prefix (0
  mentions on main), and the branch-name test exits 0.
• The pre-push step's test exits non-zero on a planted-token fixture and 0 after its revert, both
  runs recorded in the PR.
• Every slice sub-issue is closed by a merged PR.

Out of scope

• Prototype evidence branches (Other plugins thread), beyond sharing the secrets check.