Add reusable repo-update-log fragment guard

[ArchonVII]

Summary

Add a reusable repo-update-log fragment guard so consumer repos can mechanically require docs/repo-update-log/*.md entries instead of relying on advisory AGENTS.md text.

Acceptance Criteria

• Add a reusable workflow that fails applicable PRs when they do not add a repo-update-log fragment.
• Permit ledger-only/backfill PRs without requiring a second ledger fragment.
• Permit unprotected doc-only typo-style PRs only when the PR body records why the repo-update-log fragment is not required.
• Require fragments for code/config/workflow/policy/protected-doc changes.
• Add a consumer example and tests covering missing fragment, added fragment, ledger-only, doc-only note, and protected-doc behavior.
• Record the change in changelog and repo-update-log artifacts.

Context

Page GM gm-20260620-193148-d562cd8f: Hudson Bend merged a #244+ wave without per-PR docs/repo-update-log/ fragments because no required check enforced the rule.