feat(framework): make implementation commits obey project policy #413

Need

An AI implementing an approved plan may create small, reviewable local commits while it works. This behavior must be governed by the project policy, not hard-coded by the implementation flow.

Current gap

The VCS-memory template exposes commit-cycle choices, while the implementation flow always commits each verified phase. As a result, the documented never choice is not enforceable and the policy does not state the safety boundary.

Scope

• Project memory records one explicit automatic-commit policy, including when commits may occur and when they may not.
• The implementation flow resolves and obeys that policy. If it is absent or set to never, it makes no automatic commit.
• When enabled, an automatic commit contains one verified unit of work and follows the project VCS convention.
• Automatic commits run only on a non-default working branch. They never push, force-push, amend history, or include unrelated pre-existing changes.
• A rejected hook stops the flow and reports the reason; it does not retry blindly.

Out of scope

• Creating a new skill, hook, or background agent.
• Automatic pull requests, remote pushes, rebases, or branch deletion.

Acceptance criteria

• Generated VCS memory expresses the project policy in actionable terms, including the branch and push boundaries.
• never and an absent policy produce no automatic commit during implementation.
• An enabled policy produces only atomic commits after the configured verification point.
• The implementation flow cannot automatically commit on the default branch or push a commit.
• A hook rejection leaves no new commit and gives a clear stop reason.