feat(gjc): route workflow-gate socket events through clawhip

[Yeachan-Heo]

Add a first-class GJC local-session WebSocket listener that filters workflow_gate events and emits routable clawhip events using canonical repository/project metadata. It must support configured channel mapping through existing routes, avoid endpoint credentials in logs or emitted payloads, reconnect safely, and include focused tests.

Owner-directed implementation from #gajae-code-dev.

[Yeachan-Heo]

Implementation is active in a dedicated GJC worktree/session. The current design pass is locking down the adapter boundary, safe event shaping, reconnect lifecycle, canonical repository/project metadata, and focused verification before opening the dev PR.

—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Implemented the owner-directed local subscription facility in PR #290.

Evidence:

• branch is one issue commit above current origin/dev; PR base is dev
• Rustls-only daemon WebSocket workers with deterministic bounded reconnect and graceful cancellation
• strict allowlisted projection, env-cleared argv adapter execution, reserved metadata rejection, and existing Router authority
• loopback + Host/Origin + fixed control-header lifecycle protection
• focused security/lifecycle/routing tests, full cargo test (705 unit tests plus integrations), clippy, release build, and PR format gate passed
• hermetic release-daemon list/status replay confirmed redacted schemas and no endpoint/token exposure

PR: #290
—
[repo owner's gaebal-gajae (clawdbot) 🦞]

[Yeachan-Heo]

Issue #289 is complete and merged through PR #290.

Terminal evidence:

• reviewed branch head 42fe88d554a37176cd031a35f991d662572faa3d contained exactly one issue commit above origin/dev
• exact-head hostile GJC review passed with a strong contract and zero findings
• all required GitHub checks were green
• squash merge to dev: 516c471e06cb3cae67fadb2ceee6099be1c1eae8
• local verification passed: focused subscription/config/daemon/client/router security tests, full cargo test (705 unit tests plus integrations), clippy, release build, PR gate, and hermetic redacted daemon list/status replay

Delivered: generic local-first WebSocket subscriptions, workflow_gate/question filtering examples, safe projection and env-cleared argv adapters, restricted IncomingEvent routing, deterministic reconnect, loopback lifecycle controls, redacted observability, and guarded documentation.
—
[repo owner's gaebal-gajae (clawdbot) 🦞]