fix: skip Windows Hello entirely when protection is Off

[Wibias]

Summary

• Protection Mode Off no longer prompts Windows Hello for independent-intent lifecycle writes such as update_pr_body, create_pr, and merge_pr.
• Sensitive actions (high-assurance) still requires Hello for those writes. Mutation-policy rules (explicit instruction, exact-text confirmation, expected-head checks) still apply under Off.
• Docs and unit tests now match the Off label: Off is the Hello opt-out, not a partial skip.

Test plan

• node --test tests/unit/authority-mode-enforcement.test.mjs tests/unit/mutation-modes-docs.test.mjs
• node scripts/pre-open-gate.mjs Wibias/github-delivery origin/main HEAD --evidence-file .tmp/off-hello-preopen-evidence.json — ready at 0cda50b0557e0e122fda21f29405c8dd317907d0

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0ff6e934-2fa1-4adb-b7d1-c76d80004af0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}