chore(git): enforce protected microcommit workflow

[0xSero]

Summary

• remove obsolete local notarization/release-secret scripts and undocumented beta launch paths
• block local commits on main/dev and direct pushes to main/dev
• enforce 15-file / 600-source-line microcommit limits
• align README contribution guidance with the dev-first workflow

Validation

• npm run check
• protected-branch commit hook rejection
• direct dev push hook rejection
• oversized 16-file commit hook rejection