Autoloop template should exclude language-specific dev files from protected-files by default

## Problem

The default `protected-files` list in the autoloop workflow template blocks common dev files that autoloop programs legitimately need to modify:

- **Go**: `go.mod`, `go.sum`
- **JS/TS**: `package.json`, `package-lock.json`, `bun.lockb`, `bunfig.toml`, `yarn.lock`, `pnpm-lock.yaml`, `tsconfig.json`
- **Python**: `requirements.txt`, `pyproject.toml`, `setup.py`, `setup.cfg`, `Pipfile`, `Pipfile.lock`
- **Ruby**: `Gemfile`, `Gemfile.lock`

When an autoloop iteration modifies any of these, the push silently falls back to creating an issue instead of a PR (`protected_files_policy: fallback-to-issue`). The iteration's code is effectively lost.

This has blocked autoloop on:
- `githubnext/apm` — Go migration, `go.mod`/`go.sum` blocked every iteration
- `githubnext/tsikit-learn` — TS project, `package.json`/`bunfig.toml` blocked
- `githubnext/tsessebe` — same pattern

## Fix

The autoloop workflow template (`workflows/autoloop.md`) should use the `exclude` form for `protected-files` to remove language-specific dev files from the default list:

```yaml
create-pull-request:
protected-files:
policy: fallback-to-issue
exclude:
- go.mod
- go.sum
- package.json
- package-lock.json
- bun.lockb
- bunfig.toml
- yarn.lock
- pnpm-lock.yaml
- tsconfig.json
- biome.json
- requirements.txt
- pyproject.toml
- setup.py
- setup.cfg
- Pipfile
- Pipfile.lock
- Gemfile
- Gemfile.lock
```

Same for `push-to-pull-request-branch`.

Files that should STAY protected: `CODEOWNERS`, `README.md`, `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, `DESIGN.md`, and `.github/` (via `protect_top_level_dot_folders`).

## Affected repos

- [x] `githubnext/tsikit-learn` — fixed in PR #13, #15
- [x] `githubnext/apm` — fixed in PR #37
- [x] `githubnext/tsessebe` — already had `max-patch-files` but should also get the exclude list
- [ ] `githubnext/autoloop` — template itself needs updating so new installs get this by default