chore(governance): document the main gate, add the release pipeline, remove loop artifacts

[AetherAI3]

Outcome

main's real gate is now documented in the repository, a release pipeline exists that refuses to build anything the gate did not pass, and internal agent-loop artifacts are gone from the public tree. Nothing in the ruleset or repository settings was modified; this PR describes what is already enforced (ruleset 21237783, read via gh api repos/AetherAI3/AntiFlock/rulesets/21237783 on 2026-08-23).

What changed

• GOVERNANCE.md: the main gate (ruleset, exact eight required contexts, 1 approval + last-push approval, stale dismissal, thread resolution, extra approval for unattributed commits, squash/rebase only, code-owner review off, no bypass actors); the independence rule (AetherAI3 and dbarrante are one person, so cross-approval is not independent security review; AI-agent reviews are advisory evidence, never the approving review); release signing (cosign keyless, workflow identity); SBOM + checksum policy; supply chain; the release baseline statement (first release-qualified tag only from a main commit whose required checks passed on that exact SHA).
• SECURITY.md: GitHub private advisory link (verified enabled), response targets table, supported versions, "who reviews and what a merge proves", release-integrity verification commands.
• docs/release-policy.md (new): rc → canary → release flow, tag format, artifact set (agent/core/ctl for linux/amd64+arm64, CycloneDX SBOM via syft/anchore/sbom-action, SHA256SUMS, cosign keyless signature bundle, cosign provenance attestation bundle), verification order, rollback, and the generic "external adversarial gate: required when configured, absent is FAIL not PASS" rule.
• docs/supply-chain.md (new): inputs/build/outputs/permissions inventory and known gaps.
• .github/workflows/release.yml (new): v* tags + workflow_dispatch (dry_run, default true). gate job (contents: read, checks: read) resolves the tagged commit, requires it to be an ancestor of origin/main, and requires every one of the eight contexts to be completed/success on that exact SHA (missing = FAIL; dry run downgrades to warnings). release job (the only job with contents: write + id-token: write) builds with CGO_ENABLED=0 -trimpath -buildvcs=true -ldflags="-s -w" from a verified-clean tree into $RUNNER_TEMP, generates the CycloneDX SBOM, writes SHA256SUMS, cosign sign-blob + cosign attest-blob --type slsaprovenance1, verifies both bundles on the runner, uploads the set as a workflow artifact, and creates a draft GitHub Release with gh release create --draft --verify-tag. Concurrency group per ref, cancel-in-progress: false. No secrets beyond GITHUB_TOKEN/OIDC. All actions pinned by full SHA with version comments (sigstore/cosign-installer v4.1.2 with cosign-release: v3.0.6, anchore/sbom-action v0.24.0, actions/upload-artifact v7.0.1, plus the existing checkout/setup-go pins).
• .github/workflows/dependency-review.yml (new): actions/dependency-review-action v5.0.0 pinned, fail-on-severity: high, license allowlist, no PR comments. Advisory (not in the ruleset).
• .github/dependabot.yml: removed the root npm entry (root has no lockfile; it produced the lockfile-less duplicates build(deps-dev): bump @types/node from 22.19.19 to 26.2.0 #37/build(deps-dev): bump eslint from 9.39.4 to 10.8.1 #38/build(deps): bump the js-root group across 1 directory with 10 updates #55); per-workspace groups kept with PR limits.
• _loopstate/** removed (8 files). .gitleaks.toml keeps the _loopstate/ path allowlist (commented) because the scan check is a full-history scan.
• CONTRIBUTING.md: "Review and merge" section. CHANGELOG.md: Unreleased entry.
• ci.yml job names untouched. .github/CODEOWNERS untouched.

Safety boundary

• No ruleset, branch, collaborator, or repository-setting mutation. Read-only gh api calls only.
• The release workflow cannot publish: releases are created as drafts and a human publishes.
• contents: write / id-token: write are scoped to the release job only; the top-level default is contents: read.
• Nothing outside the S1 lease was edited.

Verification

• YAML parse (WSL PyYAML 6.0.3): python3 -c 'import yaml; yaml.safe_load(open(f))' for release.yml, dependency-review.yml, dependabot.yml → all OK.
• go run github.com/rhysd/actionlint/cmd/actionlint@latest -no-color -oneline .github/workflows/release.yml .github/workflows/dependency-review.yml (WSL, tool run only, no module change) → first run flagged runner.temp in job-level env (fixed: DIST now set via $GITHUB_ENV); second run → no findings.
• Gate logic exercised against live check runs (read-only):
  • 30c4197c (main) → all eight contexts ok, GATE=PASS.
  • mutation (require conclusion failure instead of success) → GATE=FAIL.
  • 6e58031b (feat(agent): verify signed plans without execution #60 head): check runs green but git merge-base --is-ancestor 6e58031b origin/main → NO, so the ancestry guard would fail it, as intended.
• Line endings: all new/changed files LF (.gitattributes eol=lf).

Follow-ups for A0 (outside this lease)

1. Dangling reference: docs/release-status.md:37 still cites _loopstate/LOOP-18/ as the evidence location; that file is S2's this wave. Suggested one-line change: point it at the CI run for the final verified commit instead.
2. .github/CODEOWNERS: PR feat(agent): verify signed plans without execution #60 rewrites it; not touched here. After feat(agent): verify signed plans without execution #60 lands, a follow-up should reconcile it with the "code-owner review not required" statement in GOVERNANCE.md (CODEOWNERS stays advisory).
3. Ruleset: consider adding Dependency review and, once S10 hands over adversarial.yml, its context to the required list (governance change; update GOVERNANCE.md table + REQUIRED_CONTEXTS in release.yml in the same PR).
4. actions/attest-build-provenance would give GitHub-generated SLSA provenance but needs attestations: write on the release job; deliberately not added here.
5. The release workflow has not executed yet (no tag, and a dry run against this branch would warn on the ancestry check by design). First real exercise: workflow_dispatch with dry_run: true after merge.

Dependabot triage (this PR's companion actions, no merges)

Closed as superseded with a one-line comment each: #35 (⊂ #56), #36 (⊂ #56), #37 (lockfile-less; #46 + #56 cover it), #38 (lockfile-less; #56 covers eslint in apps/web), #55 (lockfile-less root group; #56 is the lockfile-backed equivalent). Left open: #42, #45, #46, #54, #56.

[AetherAI3]

R0 fixes pushed in 6530d90: SHA256SUMS now enumerates the 7 artifacts explicitly (agent/core/ctl x amd64/arm64 + SBOM), checks each exists, checks the line count, and runs sha256sum -c --strict before and after signing (local repro: old glob listed 4/7). Manual workflow_dispatch never creates a release (only a pushed tag does), persist-credentials: false on the gate checkout, GOVERNANCE self-review wording now points at the controller ledger. actionlint clean, YAML parses.

[AetherAI3]

R0 independent exact-head review — 6530d90: APPROVE-EXACT-HEAD. Prior blocking defect (SHA256SUMS glob missed antiflockctl_* and the SBOM) is fixed: seven artifacts enumerated explicitly, per-file existence check, line-count guard, sha256sum -c --strict before and after signing. actionlint clean; workflow_dispatch can no longer create a release; gate checkout uses persist-credentials: false. Docs match ruleset 21237783 verbatim. All required contexts plus Dependency review green on this SHA. Non-blocking follow-ups: docs/release-status.md:37 still cites the removed _loopstate/LOOP-18/ (owned by the agent-lifecycle lane). This comment is not an approval; the approving review must come from @dbarrante.