Add pipeline governance orchestrator

[leether]

Summary

• Add scripts/preflight.py for machine-readable md2video readiness checks.
• Add scripts/orchestrator.py as a governed dry-run envelope that writes JSONL step logs and a run manifest.
• Add SelfReport no-write/json mode so CI can validate self-reporting without mutating governance files.
• Add privacy gate, unit tests, CI dry-run coverage, and task/docs updates.

Privacy boundary

• The orchestrator dry-run does not call paid or external generation services.
• The privacy gate blocks common token/private-key/credential patterns and local user paths in tracked text.

Validation

• .venv/bin/python -m unittest discover -s tests -p "test_*.py"
• .venv/bin/python -m py_compile $(git ls-files "*.py")
• .venv/bin/python scripts/smoke_imports.py
• .venv/bin/python scripts/preflight.py --input examples/example_article.md --allow-dirty-output --json
• .venv/bin/python scripts/orchestrator.py --input examples/example_article.md --output-dir /tmp/md2video-dry-run-output-final --log /tmp/md2video-pipeline-final.jsonl --dry-run --skip-command-checks --allow-dirty-output
• .venv/bin/python scripts/verify_cta_resources.py
• .venv/bin/python harness/self_report.py --no-write --json
• bash scripts/privacy-check.sh --full
• git diff --cached --check