[Pigbibi]

Summary

Add collaboration rules, a skill candidate and an optional exact-head Codex
prerequisite to the read-only reusable observer. This includes workflow code.

Why

Progress and review rules have diverged: source progress must follow current PR
state, and review evidence must precede merge. The historical eleven-item batch
also needs an explicit record of missing identities rather than guessed PRs.

Changes

• Require trusted completed current-head codex-review-state:v1 evidence without
  unresolved findings before merge; preserve independent review and native gates.
• Prohibit review-after-merge and marker backfill; preserve historical findings.
• Make issue 量化主线进度 #36 a daily derived brief and retire issue 协调中继：DeepSeek ↔ Grok Bot（指令与回复都放这里） #38 in the proposed rules.
• Add a reviewable skill candidate and opt-in workflow input, default false;
  merge_authorized remains false. Existing callers and App identities are unchanged.
• Preserve queue priorities #962, #702, #771, #462. The remaining seven identities
  are unavailable and explicitly unassigned; the eleven-PR batch is incomplete.

Testing

• node --test scripts/test-governance-shadow.cjs: 68/68 pass, including new
  fail-before/pass-after marker, transport, drift and concurrency cases.
• python3 -m unittest discover -s scripts -p 'test*.py': 59/59 pass.
• Central scripts/check_style.py phases 1 and 2: exit 0, 0 blocking,
  1 existing README advisory; identical on the indexed base tree.
• YAML read-only permissions/default, relative links, eleven-slot queue structure,
  skill creator quick validator and git diff --check pass.

Risk and rollback

The marker is necessary evidence only; it cannot prove base/scope acceptance,
native CI or owner authorization. Two reads cannot make merge atomic. The
existing dedicated bot must revalidate before disposition. The skill is not
installed and no caller, issue, required check, branch protection or ruleset is
changed. Roll back through a separately reviewed revert of these eight files.
No labels, merge, deploy, Secret/IAM changes, production switch changes or trading
operation is included; production switch values were not inspected.

Breaking changes

None for existing shadow callers: the new input defaults to false. Actual bot,
issue and required-check adoption remains separate and is not applied here.

Checklist

• This PR follows the organization documentation style guide.
• Summary states that this includes workflow code rather than docs only.

AI assistance

Codex, GPT-6.1 Sol (host configured).

Publication checker

Checker: publication-check/2.0-advisory; build 2947dd7867b4; matching lines: 35; advisory findings: 35.
The full tracked candidate was scanned; all eight changed files separately have 0 matches. First 20 masked full-tree entries follow. Existing matches are unchanged; no credential is introduced.

repo/.<PROJECT_ID>/CODEOWNERS:4: /.<PROJECT_ID>/CODEOWNERS @<PROJECT_ID>
repo/.<PROJECT_ID>/CODEOWNERS:5: /.<PROJECT_ID>/workflows/ @<PROJECT_ID>
repo/.<PROJECT_ID>/workflows/risk-gate.yml:79:                 approved = latest?.event === 'labeled' && latest.actor?.login === '<PROJECT_ID>';
repo/.gitleaks.toml:7: id = "<HOST>"
repo/.gitleaks.toml:18: description = "Only explicit <PROJECT_ID> JSON placeholders in the scanner fixture"
repo/AGENTS.md:75:   `gs://<bucket>/...` and `<account-id>`, and use <PROJECT_ID> values in
repo/docs/STYLE_GUIDE.md:163: | Dated status banners in a README | "<PROJECT_ID> source check: merged; acceptance pending" | Replace with a present-tense status sentence, or remove. Dated evidence records are separate. |
repo/docs/STYLE_GUIDE.md:387: # Console gap audit, <PROJECT_ID>
repo/docs/STYLE_GUIDE.md:446: > <PROJECT_ID> 源码核对：库与所选平台 adapter 已合并；生产数据可用性及交易周期验收另行确认。
repo/docs/adr/0001-incremental-architecture-boundaries.md:117: - Compare the baseline and candidate at the same boundary using fixed <PROJECT_ID>
repo/docs/architecture-conventions.md:175: consistent with the changed content, and use <PROJECT_ID> resource names in examples.
repo/docs/secret-scanning.md:63: It adds `<HOST>`, matching
repo/docs/secret-scanning.md:159: | `<PROJECT_ID>/PushPlusSmsToTelegram` | Intended `state` branch |
repo/docs/secret-scanning.md:160: | `<PROJECT_ID>/TelegramAutoSignBot` | `logs` branch |
repo/docs/secret-scanning.md:161: | `<PROJECT_ID>/GoogleVoicePulseBot` | `logs` branch |
repo/scripts/check_cross_repo_links.py:51:     "<PROJECT_ID>": ("repos", None),
repo/scripts/check_cross_repo_links.py:52:     "<PROJECT_ID>": ("repos", "<PROJECT_ID>"),
repo/scripts/check_cross_repo_links.py:72:             # <PROJECT_ID> and <PROJECT_ID> live in one directory; the name is what
repo/scripts/check_cross_repo_links.py:74:             is_gdei = path.name.startswith("<PROJECT_ID>")
repo/scripts/check_style.py:102: # finding. `<PROJECT_ID>-` is on the list because the organisation's fixtures are