fix: pilot findings from 0.2.1

[vannt-dev]

Fixes #9: what the first two pilots (vannt-dev/token-efficient-work#3, vannt-dev/convert-md-to-pdf#2) needed by hand.

• YAML keys keep the file's formatting. Adding, replacing or removing a managed key now rewrites only that key's lines; the rest of an existing workflow keeps its indentation and flow lists. If the spliced text doesn't parse to exactly the expected data (flow-style parents, odd shapes), it falls back to the old full re-render.
• .gitattributes: one line per extension. gitattributes has no brace expansion, so *.{png,...} binary and the PowerShell CRLF rule never applied (checked with git check-attr).
• Default branch: init reads origin/HEAD and records github.default_branch when it isn't main; CONTRIBUTING.md names that branch.
• Release manifest starts from the latest vX.Y.Z tag (major tags like v0 are skipped) when the stack has no version of its own.
• CONTRIBUTING setup starts with "Run" when the stack has no install command.
• owned takes path#key (and path#block), covering that key and everything under it. The unmanaged/conflict hints print the exact entry to add.
• Bug found on the way: adding a managed output to owned made the next update delete it (the lock still listed it as dropped output). Owned lock entries are now handed over: left in place and dropped from the lock.
• A seed the standard stops generating (e.g. .release-please-manifest.json after release: false) is reported as left instead of silently.
• README/spec: owned keys, default branch detection, and the script stack's shfmt -w / PSScriptAnalyzerSettings.psd1.
• Standard moves to 1.2.1. All commits are fix:, so release-please proposes 0.2.2.

Verified: 185 tests pass (new unit and end-to-end tests for each item), and check with this build on both pilot repos reports exactly the expected changes.

🤖 Generated with Claude Code