v1: stable reusable workflows + shared-config

Tracks the v1 line of org-wide reusable workflows and Claude Code config:
  .github/workflows/ci-java.yml
  .github/workflows/ci-python.yml
  .github/workflows/ci-rust.yml
  .github/workflows/ci-typescript.yml
  shared-config/session-start-global-deny.sh
  shared-config/session-start-maven-proxy.sh

Consumer repos should reference reusable workflows as
  uses: runcycles/.github/.github/workflows/ci-<lang>.yml@v1
instead of @main so org-internal supply-chain matches the pinned-SHA
posture used for third-party actions. The tag will move within the v1
line for compatible changes; breaking changes will bump to v2.

Closes #60