feat(governance): deploy advisory defaults v3.1

[cryptoxdog]

Problem

Quantum-L9 needs organization-wide governance defaults, advisory security posture,
and consistent issue intake without duplicating CI owned by l9-ci-sdk or
l9-ci-core. The v2.0.1 deployment left three gaps: strict-by-default PR gates
(blocking posture on young infra), core.setFailed in issue triage (red X on
credential warnings), and no rulesets, secret-scanning setup, weekly reporting,
or dependabot seeding.

v2.0.1 governance-pr.yml:    strict default: true   (blocking)
v2.0.1 governance-issue.yml: core.setFailed(...)    (fails the run)
missing: governance-report.yml, rulesets/, enable-secret-scanning.sh, dependabot seed

Fix

Deploys .github pack v3.1: inherited community-health files, reusable advisory
governance (strict defaults to false), evaluate-only rulesets, alert-only secret
scanning setup, one-time CODEOWNERS/caller/Dependabot seeding, issue forms, and
weekly posture reporting. Collisions were merge-reconciled rather than overwritten:
the repo's resolved CODEOWNERS (@Quantum-L9/platform), superset labels.yml,
python-based sync-labels.sh, hardened preflight.sh, and PR-kit template body were
kept; the pack's advisory semantics, boundaries docs, and new scripts were adopted.

Risk

• Low — advisory, additive, reversible
• Medium — shared code, config, or public interface
• High — breaking, migration, IAM/network, irreversible

Blast radius: organization governance metadata; no application runtime.
Rollback: repoint v1, disable evaluate rulesets, revert this PR.

Evidence

$ bash scripts/verify-pack.sh
OK  PR governance defaults advisory
OK  issue governance cannot fail the run
OK  org-advisory-hygiene.json evaluate
OK  org-advisory-pr.json evaluate
OK  no CI execution duplicated in defaults workflows
OK  push protection guarded by explicit opt-in
... 40 assertions ...
PASS v3.1 pack is advisory and boundary-clean

$ bash scripts/preflight.sh
OK .github repo is PUBLIC (inheritance active)
OK team platform exists
38 repos: actions=on allowed=all
preflight complete — no changes were made. (exit 0)

$ for slug in $(grep -rhoE '@Quantum-L9/[A-Za-z0-9-]+' .github/CODEOWNERS templates/CODEOWNERS.repo | sed 's|@Quantum-L9/||' | sort -u); do gh api orgs/Quantum-L9/teams/$slug --silent && echo OK $slug; done
OK platform

Gates

• Regression test added that fails without this fix — scripts/verify-pack.sh asserts strict=false, no setFailed, evaluate-only rulesets; it fails on the v2.0.1 tree
• No secrets, tokens, or customer data in code, tests, fixtures, or logs
• semgrep clean, or findings triaged below — n/a: governance metadata only, no application code; SonarCloud + semgrep already run as checks on this PR
• New IAM / workflow permissions are least privilege and enumerated — governance-report: issues:write; seed-governance: contents:read + App token via protected environment
• Third-party actions pinned to a full commit SHA
• Public interface change is documented and versioned — v1 alias moves to v3.1.0 after merge; callers unchanged
• Observability exists for the new path (metric, log, trace, or alert) — weekly governance-report.yml posts/updates an advisory posture issue

Reviewer focus

Verify real CODEOWNERS team slugs, advisory defaults, and CI ownership boundary.
Confirm push protection stays off and every ruleset JSON says "enforcement": "evaluate".

Changes by intent

Added

• .github/workflows/governance-report.yml — weekly read-only posture report issue
• docs/ADVISORY.md — advisory-first promotion ladder
• docs/AGENT-DEPLOYMENT-RUNBOOK.md — phase-by-phase deployment playbook
• docs/BOUNDARIES.md — CI ownership map; what this repo must never do
• docs/DEPLOYMENT-EVIDENCE-TEMPLATE.md — evidence artifact template
• docs/DEPLOYMENT-PR.md — canonical deployment PR body
• rulesets/README.md — evaluate-only ruleset usage
• rulesets/org-advisory-hygiene.json — evaluate-mode branch hygiene ruleset
• rulesets/org-advisory-pr.json — evaluate-mode PR ruleset
• scripts/apply-rulesets.sh — applies rulesets, refuses non-evaluate
• scripts/enable-secret-scanning.sh — alerts on, push protection opt-in only
• scripts/verify-pack.sh — offline advisory/boundary assertions
• templates/dependabot.yml — seeded weekly dependency PRs, no auto-merge

Modified

• .github/workflows/governance-pr.yml — strict now defaults to false (advisory)
• .github/workflows/governance-issue.yml — core.setFailed → core.warning (never fails)
• .github/workflows/seed-governance.yml — also seeds dependabot.yml; boundary notes
• .github/ISSUE_TEMPLATE/1-bug.yml — v3.1 revision
• .github/ISSUE_TEMPLATE/2-feature.yml — v3.1 revision
• .github/ISSUE_TEMPLATE/3-task.yml — v3.1 revision
• .github/ISSUE_TEMPLATE/config.yml — adds CI-failure routing to l9-ci-debt-resolver
• .github/pull_request_template.md — canonical-path comment prepended
• CONTRIBUTING.md — v3.1 rewrite (boundaries, advisory model)
• README.md — v3.1 rewrite (layout, activation, boundaries)
• docs/AUDIT.md — v3.1 findings
• docs/DISTRIBUTION.md — v3.1 distribution model

Files touched

25 files — 25 files changed, 1318 insertions(+), 233 deletions(-)

(root)/

• CONTRIBUTING.md — modified
• README.md — modified

.github/

• pull_request_template.md — modified

.github/ISSUE_TEMPLATE/

• 1-bug.yml — modified
• 2-feature.yml — modified
• 3-task.yml — modified
• config.yml — modified

.github/workflows/

• governance-issue.yml — modified
• governance-pr.yml — modified
• governance-report.yml — added
• seed-governance.yml — modified

docs/

• ADVISORY.md — added
• AGENT-DEPLOYMENT-RUNBOOK.md — added
• AUDIT.md — modified
• BOUNDARIES.md — added
• DEPLOYMENT-EVIDENCE-TEMPLATE.md — added
• DEPLOYMENT-PR.md — added
• DISTRIBUTION.md — modified

rulesets/

• README.md — added
• org-advisory-hygiene.json — added
• org-advisory-pr.json — added

scripts/

• apply-rulesets.sh — added
• enable-secret-scanning.sh — added
• verify-pack.sh — added

templates/

• dependabot.yml — added

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud