fix: align commit checks with repository governance standards

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,5 +1,3 @@
-
-
 ## AI assistance
 
 Which AI tool and model were used? Write `None` if no AI was used.
@@ -11,3 +9,11 @@ Describe the change and its purpose.
 ## How verified
 
 List the checks run and their results. Explain any checks that could not run.
+
+## Why
+
+<!-- Explain the problem this change resolves. -->
+
+## Risk
+
+<!-- Record the risk tier, affected paths and relevant compatibility or operational impact. -->

.github/workflows/engineering-governance.yml

@@ -66,6 +66,6 @@ jobs:
           tool="$RUNNER_TEMP/governance-commitlint"
           npm install --prefix "$tool" --ignore-scripts --no-audit --no-fund \
             @commitlint/cli@21.2.4 @commitlint/config-conventional@21.2.4
-          printf '%s\n' "module.exports = {extends: [require.resolve('@commitlint/config-conventional')]};" > "$tool/commitlint.config.cjs"
+          printf '%s\n' "module.exports = {extends: [require.resolve('@commitlint/config-conventional')], defaultIgnores: true, ignores: [(message) => /^Merge /.test(message)], rules: {'subject-case': [0], 'header-max-length': [2, 'always', 72], 'type-enum': [2, 'always', ['feat', 'fix', 'docs', 'refactor', 'test', 'chore', 'perf', 'ci']]}};" > "$tool/commitlint.config.cjs"
           node "$tool/node_modules/@commitlint/cli/cli.js" \
             --config "$tool/commitlint.config.cjs" --from "$PR_BASE" --to "$PR_HEAD" --verbose

AGENTS.md

@@ -89,10 +89,11 @@ Organization documentation rules are checked by `python scripts/check_style.py`,
 
 ## Commits and pull requests
 
-Conventional Commits with an English imperative subject of 72 characters or
-fewer: `feat` `fix` `docs` `refactor` `test` `chore` `perf` `ci`. PR titles and
-descriptions are English and state the problem, the resulting behaviour and the
-checks actually run. Do not push to the default branch directly.
+- Commit and PR titles use professional English, imperative Conventional Commits (`feat`, `fix`, `docs`, `refactor`, `test`, `chore`, `perf`, `ci`) and at most 72 characters. Sentence case is allowed; commitlint ignores merge commits.
+- PR descriptions explain the problem, changes, verification and risk. AI-authored PRs identify the tool and the model when available. Labels and approval or risk summaries use professional English.
+- Use `risk:low` for documentation, tests and ordinary checks; use `risk:high` and `needs-owner-approval` for protected paths. Classification labels describe risk; the path-based `risk-gate` determines whether approval is required.
+- AI-only development uses required automated checks, template validation and independent AI review when available, with zero required human or code-owner approvals. High-risk paths require the owner's `owner-approved` label; agents must never add or remove it.
+- Preserve required checks and branch protection; merge only through normal checks. Use `<type>/<topic>` PR branches; never push directly to the default branch or force-push a reviewed branch. Commit, push, merge and production actions require authorization; existing authorization remains valid within its scope.
 
 ## Scope and authorization