feat(orchestration): add lane grant isolation scaffold

[dmae97]

Summary

• Add a typed lane grant contract for root-orchestrated subagent lanes.
• Validate explicit lane provisioning fields: authority, scope, skills, hooks, MCP, acceptance, and evidence output.
• Add read-only/write-scoped authority guards, evidence output confinement under .omk/runs, and repo-path traversal checks.
• Add deterministic lane isolation planning for work/<runId>/<laneId> branches and .omk/worktrees/<runId>/<laneId> paths.
• Add conflict detection for parallel writer lanes and duplicate evidence outputs.

Validation

• npm run build
• node --test test/lane-grant.test.mjs test/worktree-containment.test.mjs test/skill-assigner.test.mjs
• npm run check
• npm run secret:scan
• git diff --check
• node node_modules/eslint/bin/eslint.js --max-warnings=0 src/orchestration/lane-grant.ts
• npm test -- --match lane-grant

Notes

• Full npm run lint still reports pre-existing unrelated issues in src/commands/chat/runtime.ts, src/runtime/chat-advisory-runtime.ts, and src/commands/chat/native-root-loop.ts; the new lane-grant file passes targeted lint.
• This PR targets v1.2/native-root-runtime, not main.