fix: certify the governed three-account Autonomy profile

[echoomegaprime]

Summary

Updates only the target-specific Echo GitHub Autonomy production-E2E policy from the retired four-account v1 contract to the Commander-approved three-account v2 contract.

• Profile: echo-github-autonomy-remote-mcp-v2
• Governed accounts: echoomegaprime, ECHO-OMEGA-PRIME, bobmcwilliams4
• Retired Bmcbob76 evidence fails closed
• Four-client consistency, 30-tool stability, public/private reconciliation, read/write/certify authority, exact identity, secret boundary, and signed collector requirements remain mandatory

Exact review evidence

• Source SHA: d54d02a5c22a731ef736cde0d1ed9e26bea2996b
• Base SHA: 3bfe40b486520be31e4bc94cb83740dbc8b224be
• 645 tests passed, 3 skipped
• Required P1 acceptance passed
• Focused Autonomy policy tests: 12 passed
• Staged gitleaks: no leaks

Security and release impact

• No secrets, private evidence, customer data, or personal information are included.
• Verdict behavior remains deterministic and fail closed.
• Public contract and operations documentation are updated.
• Deployment will be staging-first with the prior immutable release retained for rollback.
• Unrelated repository history and license boundaries are preserved.

Draft only. No merge, auto-merge, main push, force update, or certificate issuance is authorized by this PR.