feat(automation): support qualified single-user Windows operation

scripts/Approve-JobjaktBacklog.ps1

@@ -1,6 +1,7 @@
 #Requires -Version 7.2
-<# The owner runs NewKey/Sign on a separate Windows identity or signing machine.
-   Only the public certificate reaches the runner. Never export the private key. #>
+<# The owner signs from a trusted operator terminal, with workers stopped.
+   Same-user unattended use additionally requires native signing-key denial probes.
+   Dedicated-runner installations may keep the key under a separate identity. #>
 [CmdletBinding()]
 param(
     [Parameter(Mandatory)][ValidateSet('NewKey','ExportPublicKey','Sign','Verify')][string]$Action,
@@ -15,6 +16,7 @@ param(
 )
 $ErrorActionPreference = 'Stop'
 try {
+    if ($Action -ne 'Verify' -and $env:JOBBJAKT_ORCHESTRATED) { throw 'Autonomous workers cannot invoke owner signing actions' }
     if ($Action -eq 'NewKey') {
         $certificate = New-SelfSignedCertificate -Subject 'CN=Jobjakt Roadmap Owner' -CertStoreLocation Cert:\CurrentUser\My `
             -KeyAlgorithm RSA -KeyLength 3072 -HashAlgorithm SHA256 -KeyExportPolicy NonExportable `