feat!: harden governed remote and release controls

[matt-bat]

Summary

• upgrade routing output to contract 2.1 with typed explicit skills, raw-byte digest-verified artifact evidence, operation-scoped gates, and legacy 2.0 normalization
• require schema-v3 governance plans with exact catalog binding, typed evidence, persisted risk inputs, closed break-glass rules, and append-only commit-range history
• enforce exact release metadata/full-diff provenance and unconditional governance checks for every pull request targeting main
• add a closed protected-main desired-state policy plus read-only drift verifier
• harden project-index parsing, generated views, conflict ownership, authorized-only skill contracts, and documentation synchronization
• hash Git-clean-filtered pre-commit manifest content through an isolated temporary index so working-tree and exact-head bindings agree
• use a dedicated byte-stable passed-artifact fixture so routing scenarios are independent of checkout line endings

Supersedes

This replaces PR #1 without rewriting its branch. Run 29637165914 proved that PR #1's fixture digest came from a mixed-EOL working copy while Actions inspected the canonical LF blob. The fix preserves raw-byte router semantics and moves checked-in scenario evidence to a -text byte-stable fixture.

Breaking change

New governed plans require schema v3 typed evidence, and new routing results emit contract 2.1. Historical schema-v1/schema-v2 artifacts and router-2.0 inputs remain readable compatibility evidence.

Governance

• Task: POST-PROTECTION-GOVERNANCE-INTEGRITY-CORRECTED-20260718
• Base: accd30d4130b82bf004dc4f1fab73f9242280f12
• Candidate: 690fe5f1aeb006c556d21a49d69ba15bf0ba3394
• Decision: critical / go
• Authorized operations: commit, push
• Excluded: force push, release, tag, deployment, publication, deletion, migration, and remote configuration

Validation

• 163 governance unit tests in a fresh canonical checkout
• 53 routing unit tests and 26 routing scenarios
• strict schema-v3 artifact validation
• exact-head governance enforcement and attestation
• policy, catalog, ordering, generated-view, history, pair, project-index, and byte-stable-fixture checks
• five JSON Schemas plus remote desired-state instance
• six YAML files and ten governance scripts
• 12 changed skill quick-validations
• 222 relative Markdown links across 103 files
• workflow/template parity, pinned dependency integrity, and staged diff hygiene
• live protected-main desired-state verification; repository rulesets empty