fix: authorize contract SHA before apply

[rldyourmnd]

Summary

• prove caller-selected contract SHA is an ancestor of reviewed main on GitHub-hosted capacity
• prevent the self-hosted/OIDC apply job from being scheduled before authorization
• split least-privilege permissions between authorization and apply
• add an adversarial side-branch rejection fixture

Closes #8

Threat model

A fork-only or otherwise unmerged commit may be fetchable by SHA from the base repository object store. It is treated as data on a hosted runner and rejected unless git merge-base --is-ancestor proves reachability from origin/main. No checked-out contract code executes before that proof.

Validation

• scripts/validate_module.sh
• actionlint .github/workflows/cd-apply.yml