ci: add central lessons governance

[Elodie Mirza (elodiejmirza)]

Description

Add the missing central-lessons and protected-delivery controls identified by the spec-kit audit under central issue #12.

The repository previously had no lessons evidence guard, no central guidance in AGENTS.md, no security/lessons PR-template sections, and no scheduled advanced CodeQL run. The accompanying live ruleset work protects main with pull-request and current-head check requirements.

PR #3 is merged and its deterministic shell-workflow test fix is now on main. The current net diff for this PR is governance controls only.

Testing

• Tested locally with uv run specify --help — not applicable; CLI runtime behavior is unchanged.
• Ran uv run pytest tests/test_lessons_evidence_guard.py tests/test_workflow_run_without_project.py -q: 14 passed on macOS/Python 3.14.
• Ran uvx ruff check scripts/check-lessons-evidence.py tests/test_lessons_evidence_guard.py tests/test_workflow_run_without_project.py.
• Ran actionlint .github/workflows/codeql.yml .github/workflows/lessons-evidence.yml.
• Ran zizmor --pedantic .github/workflows/codeql.yml .github/workflows/lessons-evidence.yml: no findings.
• Ran gitleaks detect --no-banner --no-git --source . --redact --exit-code 1: no leaks.
• Tested the guard against a scoped workflow change and the PR test: isolate shell workflow trust #3 lessons body.

Security Review Evidence

• Changed files reviewed: AGENTS.md, PR template, advanced CodeQL workflow, lessons workflow/guard, and guard tests.
• CodeQL keeps least-privilege permissions; checkout credentials are not persisted.
• The lessons workflow has read-only contents permission and evaluates only event metadata and the checked-out diff.
• Advanced CodeQL remains authoritative and gains a monthly schedule so it stays active under the enforced organization security configuration.
• Findings fixed before commit: two checkout credential-persistence findings, implicit workflow permissions, and undocumented security-events: write.
• Open findings: none.
• Residual risk: the lessons check cannot become an enforced required context until its workflow exists on main; the live ruleset initially enforces all existing stable checks.

Lessons Learned

• Central register reviewed: SoloSentryOrg/github-enterprise-management-solosentry/docs/lessons-learned/register.json.
• Active RCA reviewed: docs/lessons-learned/pubsub-image-factory-migration-2026-06 in the central governance repository.
• LL-0002: the test and CodeQL failures were root-caused before further fix-forward.
• LL-0003: the repository retains one authoritative advanced CodeQL workflow and does not add a duplicate readiness layer.
• LL-0004: live default-setup, inherited security configuration, ruleset, and current-head check names were read back through GitHub APIs.
• Considered but not applicable: LL-0007; this PR performs no branch/worktree cleanup.
• Complexity removed or justified: the maintained central guard is reused, implicit test state is removed by test: isolate shell workflow trust #3, and one small workflow enforces PR evidence.
• Tracking issue or project item: central issue #12, Project 9.

AI Disclosure

• I did not use AI assistance for this contribution
• I did use AI assistance (describe below)

Codex performed the repository audit, live GitHub configuration readback, control implementation, secure workflow review, test execution, and PR preparation.