fix(safety): add protected file guard to prevent bots deleting state files

Rhodibot deleted Burble's TODO.md and pushed empty CONTRIBUTING.md
boilerplate because (1) is_fixable() included files with no templates,
(2) fixer.rs happily created empty files, and (3) confidence.rs had
no concept of protected files.

Three fixes:
- confidence.rs: is_protected_file() blocks deletion/modification of
  TODO, README, CHANGELOG, .scm, .a2ml, and files in .machine_readable/,
  src/abi/, docs/, spec/, verification/ — always forces Low confidence
- fleet.rs: removed CONTRIBUTING.md and CODE_OF_CONDUCT.md from
  is_fixable() (no templates exist, produces empty boilerplate)
- fixer.rs: refuses to create files when template produces empty content

17 new tests covering all protected file scenarios.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

bots/rhodibot/src/fleet.rs

@@ -100,9 +100,14 @@ fn suggestion_for(check_name: &str) -> Option<String> {
 }
 
 /// Whether a failed check can be auto-fixed by robot-repo-automaton
+/// Whether a failed check can be auto-fixed by robot-repo-automaton.
+///
+/// Only files with proper templates in robot-repo-automaton/templates/ are
+/// fixable. Files without templates (CONTRIBUTING.md, CODE_OF_CONDUCT.md)
+/// would produce empty boilerplate and are excluded.
 fn is_fixable(check_name: &str) -> bool {
     matches!(check_name,
-        "SECURITY.md" | "CODE_OF_CONDUCT.md" | "CONTRIBUTING.md" |
+        "SECURITY.md" |
         ".editorconfig" | ".gitattributes" | ".gitignore" |
         ".claude/CLAUDE.md" | ".machine_readable/bot_directives"
     )