docs: add git workflow hygiene section

[CodeSigils]

Project

Docs — proposals/ROADMAP.md. No list entry or payload change.

Why it belongs

Adds a concise Git workflow hygiene section capturing four operational lessons from the
contract-monitor wave (PRs #105–#110) that were previously only implicit:

1. Squash-merge every PR (gh pr merge N --squash --delete-branch) — one commit per PR, remote branches self-clean.
2. Direct-merge bot PRs — main has no required status checks, so GitHub declines --auto on already-mergeable PRs
   (Pull request is in clean status (enablePullRequestAutoMerge)); workflow-created PRs must be merged with a direct
   gh pr merge N --squash --delete-branch.
3. All changes land as GitHub-signed squash merges — main requires verified signatures (required_signatures: true);
   unsigned direct pushes are rejected (GH006). Never push to main directly.
4. Pushing workflow files needs a workflow-scope token — a fine-grained PAT without workflow scope is refused for
   .github/workflows/**.

Placed next to the existing "Solo evaluation branch policy" section, matching the file's terse reference style.

Quality evidence

• Docs-only: proposals/ROADMAP.md +15 lines, single section + a dated implementation-record line.
• Every claim reflects behavior verified live during the chore: auto-fix URL drift detected by contract monitor #105→docs: record contract-monitor automation flow #110 wave (clean-status --auto declination on
  required_signatures-only main; GH006 rejection of unsigned direct pushes; workflow-scope token requirement).
• SKILL.md, README.md, and CONTRIBUTING.md are already aligned with the current automation flow; no other file changes.

Checklist

• One project per PR.
• Read CRITERIA.md / contribution guidance before proposing.
• This is a docs/maintenance change, not a list entry — format and alphabetical rules do not apply.
• Description uses independently verifiable facts.
• Not a tutorial, sample, or commercial/promotional material.
• No new advisory signals introduced.
• Did not edit advisory-baseline.json or repo-exceptions.json.
• All local tests pass (uv run pytest / lint as applicable).
• Revision-history / implementation-record entry included.
• Opened against the default branch.