fix(classifier): enforce AI enablement interlock

[F-e-u-e-r]

Problem

ai.enabled was documented as an operational switch but was only displayed. The CLI also did not load config/ai.yaml by default, so an absent explicit --config silently used defaults.

Changes

• Load config/ai.yaml by default when it exists.
• When disabled, classifier plan writes a valid empty manifest without README discovery or GitHub credentials.
• Reject any AI-artifact PR in verify-ai-provenance while classification is disabled.
• Document the required explicit opt-in and add configuration/CLI regression coverage.

Verification

• pnpm p3-gate passed: 66 test files, 458 tests, build, and schema drift checks.

Operational use

Before the first executor run, commit a secret-free config/ai.yaml with ai.enabled: true, one executor kind, and a conservative valid budget. The executor token remains external.