Support explicit maintainer fresh-bootstrap reset without deleting history #2188

Problem

Historical Cast PRs are always classified as current bootstrap evidence: an open squad/bootstrap-cast PR resumes, while closing it creates an intentional opt-out. Deleting its branch or renaming its title cannot safely enable a fresh test. This blocks a maintainer-approved fresh bootstrap after failed/stale artifacts.

Scope

Working as agentic-workflows-dev (Agentic Workflows Engineer). Add an explicit, authenticated, supported fresh-bootstrap reset operation while preserving default recovery and closed-unmerged opt-out semantics. Preserve history; do not automatically delete issues, PRs, or branches, reset installed teams, bypass provenance, or mutate consumers.

Acceptance criteria

• Explicit maintainer opt-in separates archived bootstrap evidence from a fresh attempt; ordinary push/manual runs retain existing behavior.
• Preflight, writer/materializer, artifact identities, review/provenance authorization, generated package, and docs remain coherent.
• Protect real installed teams and fail closed on ambiguity, invalid authorization, and unsafe concurrent/repeated attempts.
• Tests cover historical bot Cast state, reset/retry, opt-out, ownership, actual compiled contracts, and package installation.
• Strict compilation, integrity, focused tests, build/typecheck, independent bounded trust-boundary review, Copilot review, and normal merge.

Context

Follow-up to #2185/#2187, explicitly requested for a fresh bootstrap rather than recovery. No consumer mutations in this issue. Existing documentation issue #2048 is distinct.