feat(framework): make implementation commits obey project policy

Trace the VCS-memory template and implementation flow to find where commit policy is generated, resolved, and applied. Inspect the existing verification, branch, commit, and hook-handling paths first; done means absent or never prevents commits, enabled policies create atomic verified commits only on non-default branches, and hook rejection stops clearly without pushing or including unrelated changes.

Need

An AI implementing an approved plan may create small, reviewable local commits while it works. This behavior must be governed by the project policy, not hard-coded by the implementation flow.

Current gap

The VCS-memory template exposes commit-cycle choices, while the implementation flow always commits each verified phase. As a result, the documented never choice is not enforceable and the policy does not state the safety boundary.

Scope

• Project memory records one explicit automatic-commit policy, including when commits may occur and when they may not.
• The implementation flow resolves and obeys that policy. If it is absent or set to never, it makes no automatic commit.
• When enabled, an automatic commit contains one verified unit of work and follows the project VCS convention.
• Automatic commits run only on a non-default working branch. They never push, force-push, amend history, or include unrelated pre-existing changes.
• A rejected hook stops the flow and reports the reason; it does not retry blindly.

Out of scope

• Creating a new skill, hook, or background agent.
• Automatic pull requests, remote pushes, rebases, or branch deletion.

Acceptance criteria

• Generated VCS memory expresses the project policy in actionable terms, including the branch and push boundaries.
• never and an absent policy produce no automatic commit during implementation.
• An enabled policy produces only atomic commits after the configured verification point.
• The implementation flow cannot automatically commit on the default branch or push a commit.
• A hook rejection leaves no new commit and gives a clear stop reason.