Drops `ContextKind::MainCheckout`. Every Context is a worktree.
Replaces `Project.default_branch` with a user-set `Project.root_branch`
discovered via `master > main > root > dev > current HEAD`, overridable
through `:root-branch <name>`. Adds `Context.source` (defaults to
`root_branch` on spawn and on hydrate-time backfill). Startup on a
protected branch with no restorable Context lands on the dashboard
rather than auto-creating a main-checkout.

`is_protected` lives as a free function in `project` so the
`{root_branch} ∪ protected_branches` union is reusable from
`delete_context` and the spawn invariant without raising the type's
RFC. The PR1-era dirty-main switch guard is gone (worktrees own their
own working tree, so switches never touch the main repo). `promote` /
`demote` are gone with `MainCheckout`. Older meta.json carrying
`default_branch` migrates silently into `root_branch` on the next load.

Tests, scenarios, harness, and the architecture doc updated to match.
The harness gains `activate_root_context(name)` so the two scenarios
that previously relied on the auto-MainCheckout layout
(`create_edit_save_close_round_trip`, `open_file_via_tree_keys`) can
explicitly materialize a Context rooted at the project directory.
Lifecycle plan §8 marks PR2 ✅.

@@ -220,0 +233,4 @@
+// truth for `root_branch`; the command is their entry point. Returns
+// None when the command doesn't match either form so the caller falls
+// through to the next dispatcher.
+fn try_root_branch_command(