feat: minimize user input requests across the harness (#743)

[kcenon]

What

Reduce how often the user is interrupted for input — permission prompts, mid-flow confirmations, manual setup steps — across the harness, without weakening any security guard. Implements epic #743 (5 workstreams).

Change types: feat (skills/install), chore (settings), fix (hook false positives).

Why

Several interruptions are pure friction: they rubber-stamp a deterministic recommendation, re-ask for context that is derivable, or block legitimate read-only operations. This came out of a multi-agent analysis (5 producer agents over the input-friction surfaces) and a review/control agent that rejected two security-loosening proposals (bash -c, python -c unblocking) after verifying real bypass risk, and caught + got fixed an awk write-redirect bypass during implementation.

Where / How

WS	Issue	Change
WS1	#744	Skills apply solo/team mode silently on unambiguous signals (still ask on conflict); sonar-fix auto-detects PR from branch; memory-review alias added; issue-work CI-timeout defaults to leave-PR-open + resume command (--wait-on-timeout to opt in)
WS2	#745	issue-create infers repo from cwd; branch-cleanup defaults to dry-run (--execute to delete); memory-review drops redundant after-5 pagination gate; research drops user-confirm halt for shallow/standard
WS3	#746	permissions.allow gains git-write / build / granular docker entries (no docker:* wildcard); deny list + defaultMode unchanged
WS4	#747	Hook false-positive fixes: read-only awk allowed (deny any >/`
WS5	#748	scripts/install.sh non-interactive --yes/env presets; git-identity auto-fill; interactive flow unchanged with no flags

Security

Every removed ask keeps a sensible default + override. No deny guard weakened: permissions.deny is byte-identical to develop (18 entries); awk guard is strictly no weaker than the prior deny-all for write forms; merge-gate fail/cancel/error still hard-block; pr-target protection decision unchanged; pre-push protected-branch block intact.

Rejected (not implemented): loosening dangerous-command-guard (bash -c) and bash-write-guard (python -c/node -e) — bypassable via obfuscation.

Testing

Hook suites green: bash-write-guard 42 (incl. 6 new awk bypass regression cases), conflict-guard 12, pr-target-guard 41, merge-gate-pending-timeout 9. Adjacent guards unaffected: dangerous-command-guard 36, gh-write-verb-guard 29, sensitive-file-guard 30. settings.json validates (allow 90 / deny 18 / defaultMode default). All edited SKILL.md frontmatter parses; pre-commit SKILL validation passes.

Closes #744
Closes #745
Closes #746
Closes #747
Closes #748
Part of #743