Enforce repo freshness before guarded repo work

[CryptoJones]

Summary

• require the git operational OMI note plus same-turn git fetch/pull freshness before repo-sensitive work
• block installed global agent config/hook/bootstrap writes unless current user prompt explicitly authorizes mutation
• update Codex AGENTS bootstrap with the repo/global-config rules and bump omind to 3.7.3

Tests

• uv run ruff check .
• uv run --extra dev --python /home/hermes/.local/bin/python3.11 mypy src
• scripts/test.sh
• uv build

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/