feat(connectors): complete ATLAS-WP-0003 — discovery connectors (Phase 2)

T01 connector_base + docs/discovery-connectors.md (read-only/stateless,
candidate->PR->promote; `candidate` added to schema status enum; candidates/
gitignored, excluded from gate).
T02 connector_reposcoping (repo-scoping facts -> candidates; graceful degrade).
T03 connector_gitconfig (deterministic scan; real .env -> secret-ref, no values;
verified 4 real candidates from ~/state-hub).
T04 connector_featurecontrol (feature-flag surfaces linking to feature-control
keys, no eval logic; FR-12).
T05 registry_health (unowned + stale detection).
Make targets: connect-gitconfig/reposcoping/featurecontrol, registry-health.

WP-0003 finished (5/5).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

schemas/surface-entry.schema.json

@@ -24,7 +24,7 @@
       "description": "Team/agent identity, resolved against domain-tree bindings. Not a person.",
       "minLength": 1
     },
-    "status": { "type": "string", "enum": ["draft", "active", "deprecated"] },
+    "status": { "type": "string", "enum": ["candidate", "draft", "active", "deprecated"] },
     "scope": {
       "type": "object",
       "additionalProperties": false,