[Deep-Sixed]

Fixes the two governance-composition findings from the review after #21/#27.

Ref-level policies compose

A destructive update to a protected ref now produces both applicable operations:

• protected + force update -> protected_ref_update and force_update
• protected + deletion -> protected_ref_update and ref_delete

This prevents a protected-ref policy from masking stricter per-operation thresholds, roles, or quorum settings.

Quorum preserves an executor

When quorum mode is enabled and the requester is itself eligible to vote, the calculated quorum leaves one eligible agent outside the required yes-vote set. This prevents requester voting plus separation of duties from requiring every possible requester/executor to approve and then forbidding all of them from carrying the operation out.

An explicit fixed --threshold remains a floor and may still require unanimity. The existing invariant that an agent who voted yes cannot execute that approval remains unchanged.

Regression coverage

• protected-ref deletion requires both ref and delete operations
• protected-ref force update requires both ref and force operations
• requester voting with three operators requires two yes votes and leaves the requester able to execute

Validation

On Friday's box:

• ruff check src tests: clean
• pyright: 0 errors
• python -m pytest tests -q: 283 passed