ci: define a stable reachability policy for cindy-protocol gitlinks

## 背景

PR #1751 新增了 `cindy-protocol` gitlink 的单调性检查：相对 PR base，指针必须保持不变或沿协议仓历史前进，回退与分叉会失败。

审查中进一步发现：单纯的祖先关系仍允许 gitlink 指向协议仓临时 feature 分支上的 descendant。若该分支后来删除，父仓中的 gitlink 可能变成不可稳定拉取的提交。

## 建议

请维护者决定并记录协议 gitlink 的稳定引用策略，例如：

- 只允许从协议仓 `origin/main` 可达的提交；或
- 允许从 `client-baseline-*` 等明确的稳定 tag 可达；
- 在客户端 CI 中验证 head OID 满足该可达性规则。

这需要协议仓发布/分支策略与客户端 CI 一起裁决，因此从 #1751 外推为独立议题。

Related: #1751

Start by reviewing PR #1751 and the cindy-protocol branch and tag policy described in this issue. Compare the proposed stable reachability rules with the client CI requirement; done means one policy is decided and recorded, and CI verifies that the gitlink head OID satisfies it.

Written by the indexing model from the issue text.