v1.7.0 shadow: run the persistent Operator in observe-only mode

[jeffhuber]

Part of #1096.

Goal

Implement the continuously running read-only Operator before enabling any repository mutation.

Dependencies

Requires the frozen contract, container, durable store, GitHub identity/reconciliation, and visibility PRs.

Scope

• code-mower operator run --once --mode observe.
• code-mower operator serve --mode observe.
• Poll/reconcile configured repositories, controller decisions, gate state, provider availability, and owner actions.
• Persist decisions and evidence but perform no issue, PR, label, branch, check, Jira, Slack, or merge mutations.
• Graceful shutdown, lease handoff, bounded backoff, and health reporting.

Acceptance criteria

• Observe mode is mechanically incapable of mutating remote systems.
• One-week shadow soak survives restarts and network/provider outages without duplicate work or lost state.
• Decisions match manual lanes status, gate-health, and controller dry-runs for the same heads.
• Board and CodeMower.com expose freshness and owner-action state without private content.
• A kill/restart during every lifecycle phase recovers deterministically.

Code Mower delivery

One focused runtime PR plus retained shadow-soak evidence. No active dispatch belongs in this PR.