ci: reconcile repository governance contract

[jmcte]

Summary

• restore the documented fast/extended CI entrypoints and repository pre-commit hook
• align runner labels with the manifest policy, active workflow, actionlint, onboarding guidance, and verified live job metadata
• make canonical GitHub inputs match projected files and fail CI on future drift
• validate local Markdown targets and exact immutable release-pin guidance
• ignore Python caches so validation leaves worktrees clean

Governing Issue

Closes #25

Validation

• Relevant local checks passed
• Required PR checks are expected to satisfy CI Gate
• Skipped checks are explained below

Commands run:

• bash scripts/ci/run-fast-checks.sh — repository contract valid; 85 tests passed
• bash scripts/ci/run-extended-validation.sh — 85 tests passed; deterministic policy release built and verified offline
• actionlint -config-file .github/actionlint.yaml
• live job metadata for job 87300794280 — runner group linux-public, labels self-hosted, linux, shell-only, public, conclusion success

Bootstrap Governance

• Changes are scoped to the linked issue
• Contributor or PR guidance changes are reflected in CONTRIBUTING.md, the canonical/projected PR template, and docs/bootstrap/onboarding.md
• Auto-merge is intentionally deferred until dependency PR docs: finalize Public Repository Standard decision record #29 lands
• No real secrets, runtime auth, or machine-local env files are committed

The reviewed Bootstrap plan and managed/product-owned inventory remain recorded on #13. This PR reconciles the issue-defined repository surfaces without claiming the blocked Bootstrap resolver/projection apply has completed.

Flow Contract

• Owner lane: Hephaestus
• Repair owner: Pheidon
• Autonomy class: Class 2 — review-gated autonomous
• Risk class: Medium — CI routing and generated-governance enforcement

Flow Merge Readiness

• Every blocker has a next actor and next action
• No active blocking requested changes remain
• Non-author approval is present when required
• Auto-merge deferral is recorded below

Merge Automation

• Auto-merge is deferred until PR docs: finalize Public Repository Standard decision record #29 merges so this PR cannot land its documentation foundation out of order. After docs: finalize Public Repository Standard decision record #29 lands, refresh the base diff and enable squash auto-merge.

Notes

• This PR currently includes PR docs: finalize Public Repository Standard decision record #29's single documentation commit because it was branched from that validated foundation. Once docs: finalize Public Repository Standard decision record #29 merges, GitHub will reduce this PR to the issue Reconcile generated governance, CI entrypoints, and operator guidance #25 commit.
• The live runner selector was verified from GitHub Actions job metadata, not inferred from YAML alone.
• No organization runner-group access or capacity was changed.

[athena-omt]

Reviewed refreshed head 33370ad after updating the branch from main.

Evidence checked:

• Full PR diff against origin/main, including CI workflow, repository contract validator/tests, hook/check scripts, governance templates, and onboarding/release guidance.
• Issue #25 acceptance criteria and absence of existing review threads.
• Fresh GitHub checks on head 33370ad: CI Gate success, Workflow Lint success, CodeQL success; Extended Validation skipped on PR event as configured.
• CI Gate runner metadata: runner group linux-public; labels self-hosted, linux, shell-only, public.
• Local validation: bash scripts/ci/run-fast-checks.sh passed with repository contract valid and 85 tests; bash scripts/ci/run-extended-validation.sh passed with 85 tests and offline policy release build/verify; git diff --check passed; generated canonical/projected template pairs match.

I could not run local actionlint on the Athena node because neither go nor actionlint is installed there, but the refreshed GitHub Workflow Lint job passed on this head.

No blocking findings.