Quarantine untrusted repositories until a Sentinel security review passes #3969

Split from #3963 (part 2); #3963's pull already scopes run tokens to their repository.

A repository migrated from outside, a fork made by a non-member, or an outside pull is untrusted by default (no switch, no "safe mode"). Until a read-only security review by Sentinel passes:

• no app deploy (production or preview),
• no check runs its code,
• no builder run is dispatched on it — the only crew pass allowed is the review itself.

The review reads install hooks (package.json scripts, postinstall), CI files, network calls, obfuscated code, committed binaries and prompt-injection text, and records pass/fail on the repository with what it found. The owner can override (recorded, with who and when).

Done: tests show a migrated repo refuses deploy, check and builder dispatch until a review passes; a passed review (or an owner override) lifts all three; a repo created on the forge by a member is not quarantined.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.