Add Forge ControlRef pointer support

[im-sham]

Summary

• Add optional control_refs pointer-list support to Forge incidents and IncidentRef projections.
• Expose ControlRef pointers through CLI --control-ref, MCP forge_log, and forge_schema.
• Update contracts, docs, templates, playbooks, and synthetic examples to preserve pointer-only Workflow Context control boundaries.

Verification

• Watched targeted ControlRef tests fail before implementation.
• .venv/bin/python -m pytest tests/test_models.py::test_structured_document_operations_incident_roundtrip tests/test_cli.py::test_log_command_accepts_structured_axes_and_pointer_refs tests/test_mcp_http.py::test_forge_schema_exposes_centralized_structured_axis_metadata tests/test_mcp_http.py::test_forge_log_accepts_control_refs
• .venv/bin/python -m ruff check .
• .venv/bin/python -m pytest
• git diff --check
• git diff --cached --check