Finish the gate: keep private specs and baselines out of the repository

[peterbjohnson]

t21 (the gate command, CI workflow and baselines) reached its cost cap before applying the four changes its review asked for. Its work is on this branch; this ticket makes those four changes and nothing more:

1. The branch commits corpus-specs/** (specs written from colleagues' private documents, quoting their headings) and gate-baseline.json (their file names and an absolute path on the maintainer's machine). Neither belongs in a public repository: git rm --cached both, add corpus-specs/ to .gitignore, and have the workbench check read the private baseline from corpus-specs/gate-baseline.json. The ci-corpus specs are synthetic: move them to ci-corpus/specs/<folder>/in2lambda-spec.yaml and point ci-baseline.json's specs there.
2. Delete .github/branch-protection.json and the README passage that enables a required status check. The workbench merges with gh pr merge as soon as its own check passes and cannot wait for a GitHub check, so a required check blocks every merge. The workflow stays as CI's report.
3. README: --cache defaults differ between corpus (./.in2lambda-agent) and gate (~/.cache/in2lambda-agent); say each once where its command is described, and say why.
4. in2lambda-agent corpus --help shows --cache, and tests/test_cli.py covers it.
   Full suite green, then offer the work.

---

Workbench ticket t31.