fix: add reroute helper diagnostics

[dmoliveira]

Summary

• preflight protected-branch and primary-worktree maintenance helper reroutes before rewriting bash commands
• add structured reroute audit context like original command, rewritten command, helper path, helper existence, and repo root
• cover missing-helper failure cases in gateway hook tests so cross-repo reroute problems fail clearly

Validation

• node --test test/primary-worktree-guard-hook.test.mjs test/workflow-conformance-guard-hook.test.mjs