Add per-customer isolation to the agent-freeze kill-switch

[JSONbored]

Problem: A global agent-freeze kill-switch already caused one real cross-repo incident within a single operator's own multi-repo install (live merges/closes fired for repos meant to stay paused) — proof by incident of exactly the bug class that becomes a customer-isolation issue at hosted scale.

Area: ORB / Cloud

Proposal: Redesign the freeze mechanism to be tenant-scoped by default, with the existing per-repo opt-back-in preserved as a within-tenant convenience.

Deliverables:

• A freeze mechanism that cannot cross tenant boundaries even by mistake.

Acceptance criteria:

• Freezing one tenant's repos has zero effect on any other tenant's repos, verified by test.

[linear-code]

JSO-3547