feat(git): namespace contrib refs per account (contrib/<user>/<topic>)

Done before anyone has a token or a branch, because renaming later breaks every
contributor. The hook compares the middle path segment to REMOTE_USER, so a token
can only write under its own namespace; deletion and cleanup become a prefix
operation instead of a guess.

Verified 4/4: own namespace accepted, neighbour's namespace refused naming the
authenticated user, missing owner segment refused with the correct form, main
refused. Test branch and token removed afterwards; queue back to 0.

0 files changed, 0 insertions, 0 deletions