Add Worker projection isolation fixtures

Scope

Implement fixture-project projection export for Worker A, Worker B, and the private integration repository. Prove the documented isolation model before integrating a real execution backend.

Worker A receives specifications and permitted tests but no implementation source or objects. Worker B receives specifications and implementation baseline but no canonical test source or objects. Integration and Triage remain private.

Dependencies

• Current projection and worker isolation decisions in docs/architecture/components.md.
• .protobot project/projection policy from the bootstrap child issue.

Acceptance criteria

• Projections use independent Git object databases and synthetic roots.
• Negative tests prove forbidden paths, objects, remotes, credentials, and peer history are unavailable.
• Unclassified paths are denied by default.
• Patch imports are path-restricted and auditable.

Start by reading docs/architecture/components.md and the .protobot project/projection policy from the bootstrap child issue. Locate the fixture-project projection export entry points and establish how Worker A, Worker B, and the private integration repository are represented. Done means independent Git object databases and synthetic roots, negative isolation tests for forbidden paths, objects, remotes, credentials, and peer history, default denial for unclassified paths, and auditable path-restricted patch imports.