fix(session): require config-backed mutation authority and workspace-bound targets (#714)

Close the #714 remediation gap left at 943d402 where env-only mutation
profiles, REMOTES Timesheet defaults treated as explicit caller input, and
machine-dependent Git remotes produced false greens.

- Fail closed when mutations lack a config-backed profile with non-empty
  allowed_repositories; env ops cannot invent mutation authority.
- Preserve omitted-vs-explicit org/repo provenance through the mutation
  gate; omitted targets bind to the verified workspace repository.
- Prefer workspace-aligned Git remotes over historical Timesheet defaults
  in MCP _resolve and CLI resolve_remote.
- Centralize deterministic config-backed mutation fixtures; migrate
  mutation tests off env-only authority without weakening security
  assertions.

Full suite: 2744 passed, 6 skipped.

tests/conftest.py

@@ -147,3 +147,17 @@ def _reset_mutation_authority(monkeypatch):
         gitea_config._active_profile_override = None
         session_ctx._reset_session_context_for_testing()
         _state_tmp.cleanup()
+
+
+# #714: deterministic workspace remotes only (no host git dependency).
+import pytest
+
+
+@pytest.fixture(autouse=True)
+def _deterministic_workspace_remotes():
+    try:
+        from mutation_profile_fixture import install_deterministic_remote_urls
+        install_deterministic_remote_urls()
+    except Exception:
+        pass
+    yield