…gate)

Adapt the L9 shared CI target model (authored for Python) to this TypeScript/npm
package. Routing architecture adopted verbatim; gates map to the repo's own npm
scripts.

- Add .github/scripts/classify_pr.py: changed-files-primary PR classifier with
  TS-aware surfaces (providers/vision/budget/control-plane), full L9 output set
  plus run_* routing booleans, unknown diffs fail closed. Validated across docs,
  app, security, workflow, dependency, contract, and unknown scenarios.
- Add .github/workflows/pr-pipeline.yml: canonical "PR Pipeline Gate" job that
  classifies then routes to lint / build+types / test / security (npm scripts),
  aggregates with if: always(), contents: read, concurrency + cancel-in-progress.
- Add governance policies: routing_policy, blocking_policy, comment_protocol.
- Add .github/labels.yml namespaced taxonomy (automation/type/area/risk) as the
  provisioning source of truth.
- Upgrade actions/checkout v4 -> v6 across all workflows, preserving SHA pinning
  (Scorecard hardening): 34e1148... -> d23441a... .
- Document file-plane changes and the settings-plane roadmap (label provisioning,
  branch protection requiring the gate, secrets) in docs/ci/convergence.md.

No production source is changed. classify_pr.py and every npm gate run clean
locally (eslint, boundary probe, tsc build, type-check, declarations, 76 vitest
tests, npm audit, package verify). Branch protection, label creation, and secrets
are settings-plane actions and are intentionally NOT applied here.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P1xeNSemqdnFScWGvUayHZ

Reverse the repo-local classifier-first pipeline (a one-repo snowflake that
followed the auditor's candidate spec) and align with the org's actual, live
source of truth: l9-ci-core's language-aware @v1 compatibility kernels
(verified against l9-ci-core HEAD and the @v1 tag — pr-pipeline.yml@v1 already
detects Node and runs ESLint/tsc/Vitest; trio-governance.yml@v1 no-ops on
non-tiered repos).

Cut (divergent classifier architecture):
- .github/scripts/classify_pr.py
- .github/workflows/pr-pipeline.yml (repo-local canonical gate)
- .github/governance/{routing_policy,blocking_policy,comment_protocol}.yaml
- .github/labels.yml
- docs/ci/convergence.md

Rationalize the lint/typecheck/test overlap (was running 4x):
- Remove .github/workflows/l9-lint-test-node.yml (copied template; its
  lint/typecheck/test are already provided by l9-pr-pipeline.yml@v1).
- Remove .github/workflows/l9-node-ts-monorepo.yml (repo-local snowflake that
  duplicated typecheck/test and double-delegated the security/scorecard kernels
  already called by l9-security.yml / l9-scorecard.yml).

Kept:
- actions/checkout v4 -> v6 across the surviving workflows (org standard,
  SHA-pinned d23441a...; not divergent).
- ci.yml as the repo-owned comprehensive contract gate (eslint boundary probe,
  package tarball contract + sha, declaration-consumer compile, 3-node matrix,
  npm audit, artifact roundtrip) — coverage no kernel provides.
- All l9-* @v1 kernel callers + l9-analysis (v2 governed preset) + publish.yml
  + supply-chain.yml.

Lint/typecheck/test now run in exactly two places with distinct roles: the org
l9-pr-pipeline@v1 baseline-hygiene kernel and ci.yml's comprehensive matrix.

NOTE (settings plane, not changed here): if branch protection required checks
referenced the removed workflows' jobs, update the required-check list after
merge or PRs will hang on never-reported checks.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P1xeNSemqdnFScWGvUayHZ