newproj: opt-in GitHub repo creation + ru registration

Implemented directly on main in 083b983a.

Commands

Create and inspect an offline plan, then explicitly authorize its effects:

acfs newproj --plan myapp --preset first-project --stack python \
  --github=private --github-repo OWNER/myapp --ru > myapp-plan.json

cat myapp-plan.json
acfs newproj --apply myapp-plan.json --yes

Replace OWNER with your GitHub account or organization. Use --github=public only for an intentionally public repository. Omit --ru if updater registration is not wanted.

The guided workflow exposes the same choices:

acfs newproj --guided

GitHub defaults to none; registration is a separate opt-in. The guide shows the visibility, exact destination, publication files, commands, and updater configuration/state paths before its final create decision.

For an interrupted apply that retained a project:

acfs newproj --apply myapp-plan.json --yes --resume

Behavior and recovery

• Local-only creation remains the default. No environment setting implicitly enables publication or registration, and applying a plan does not accept destination/visibility overrides.
• Apply checks required tools, GitHub authentication, and name availability before creating or populating the local project. Lookup failures are not treated as proof that a name is available.
• The initial commit contains only the explicitly listed generated files. Recovery state, Agent Mail connection settings, Beads runtime files, and unrelated/staged user files are excluded. Existing AGENTS.md permission requirements remain in effect for future work.
• Creation, publication, and updater registration have separate checkpoints. A later failure reports the repository URL/ID, recorded commit, confirmed or unconfirmed publication, and updater status. No automatic rollback deletes the local project or remote repository.
• Resume verifies the immutable repository ID and exact visibility, the reviewed files, Git configuration, branch and commit. It does not adopt an unrelated same-name repository, publish subsequent commits, follow alternate push URLs, or force-push. An initial push whose acknowledgement was lost is reconciled against remote main.
• ru receives the reviewed configuration/state directories, registers in the appropriate visibility list, and is read back to verify the registration rather than relying solely on its exit status.

Remaining limits

This is for new repositories on GitHub.com through the reviewed --plan / --apply / --guided modes. The older positional CLI and --interactive TUI remain local-only. GitHub publication requires an explicit --github-repo OWNER/REPO and the git feature.

ru registers repository identity; subsequent syncs use its existing projects directory/layout. This workflow does not configure an arbitrary local-path mapping or run ru sync.

If creation may have succeeded but its repository ID was not durably checkpointed, automatic resume stops for manual review. Organization policies or a name claimed after preflight can also reject creation; partial local work is retained.

Validation

All 106 bootstrap regressions passed in a fresh run, including 36 new end-to-end tests using strict GitHub/ru fixtures and real Git commits/pushes into isolated bare repositories. Coverage includes public opt-in, failures and interrupted acknowledgements, changed identities/visibility/remotes, staged secrets, guided flows, and actual exclusion of private Agent Mail files/tokens from the pushed tree.

The full suite now has an independent CI job. Targeted ShellCheck, generated-artifact checks, all 121 runtime checksum checks, and 461 manifest contract checks passed. README/onboarding documentation and the canonical runtime checksum are updated. The host-specific external Flywheel checker and UBS were unavailable in this environment; those checks are not claimed.