feat: read the chant/lifecycle ledger paths and ruleset from the status contract

[lex00]

Part of #62.

Adds github-warden lifecycle. It runs chant workspace status <env> --json (contract 1) and reads the branch name from lifecycle.ref and each member's release ledger and gate ledger paths from the document, with nothing hard-coded. --format ruleset prints a ruleset for that branch (rules deletion and non_fast_forward, appends still allowed) in the shape the rulesets cycle already reconciles under repos.<repo>.rulesets. A test loads it through the governance config loader.

Acceptance criteria:

• The warden reads the member list from chant workspace ls --json (feat: read workspace members from chant's read contract and generate CODEOWNERS #63).
• It also reads generated job names and lifecycle paths from the contract. Lifecycle paths are read here. Job names wait on workspace read contract: publish each member's generated pipeline files and job names (INTENTIUS/github-warden#62) chant#3050.
• Required checks can be declared per member pipeline. Blocked on workspace read contract: publish each member's generated pipeline files and job names (INTENTIUS/github-warden#62) chant#3050.
• The chant/lifecycle branch can be protected by a ruleset.
• CODEOWNERS entries can be declared per member directory (feat: read workspace members from chant's read contract and generate CODEOWNERS #63).

Local checks: npx tsc --noEmit, npm test (578 passed, with a test against a real chant workspace), the mock smoke, npm run lint:prose, and the CLI run against a temp workspace.