Select direct versus fork-first publication from repository-owner policy

[chubes4]

Problem

Workspace publication can execute direct-origin and cross-fork routes, but route selection is topology/input-driven. The maintained-owner policy still lives in agent prose.

Contract

Add a generic publication policy with explicit direct-push owner/repository rules and a default fork-first mode.

Acceptance criteria

• Define machine-readable owner/repository publication policy.
• Select direct origin for configured owners/repositories.
• Default external owners to fork-first publication.
• Reject direct publication when policy requires a fork.
• Keep credentials and host routing separate from owner policy.
• Surface the selected route and policy source in publication evidence.
• Tests cover configured direct owners, external default, explicit repository override, GHE hosts, and missing fork remotes.

Context

The execution primitives already exist in RunnerWorkspacePublisher; this issue moves route selection out of RULES.md.