Make S1 handoff read-only by default

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

.forgejo/workflows/ci-smoke.yaml

@@ -28,6 +28,7 @@ jobs:
           python3 -c 'import yaml'
           python3 scripts/inventory_contract.py
           python3 scripts/baseline_contract.py --check-repo
+          python3 scripts/handoff_contract.py
           python3 scripts/sops_rotation.py --check
           python3 scripts/s1_receipt.py docs/evidence/s1-receipts/*.json
           python3 -m unittest discover -s tests -v