Integrate repo-guard into pjson PR workflow

[konard]

Fixes #17

Summary

• Adds .github/workflows/repo-guard.yml as a pull request policy gate using the pinned reusable netkeep80/repo-guard Action in check-pr mode.
• Keeps the existing requirements validators in parallel and adds scripts/validate-repo-guard-workflow.js so workflow/policy/template wiring is checked in CI.
• Documents the PR change contract and requirement anchor fields in README.md and .github/PULL_REQUEST_TEMPLATE.md.

Change Contract

change_type: ci
scope:
  - ".github/workflows/**"
  - ".github/PULL_REQUEST_TEMPLATE.md"
  - "README.md"
  - "repo-policy.json"
  - "scripts/validate-repo-guard-workflow.js"
  - ".gitkeep"
budgets:
  max_new_files: 3
  max_new_docs: 0
  max_net_added_lines: 500
anchors:
  affects:
    - FR-006
  implements: []
  verifies:
    - FR-006
must_touch:
  - ".github/workflows/repo-guard.yml"
  - "scripts/validate-repo-guard-workflow.js"
must_not_touch:
  - "requirements/**"
  - "docs/**"
expected_effects:
  - Pull requests run repo-guard against the requirements-aware policy and publish readable diagnostics.

Reproduction

Before the rollout, node scripts/validate-repo-guard-workflow.js failed because .github/workflows/repo-guard.yml was absent and the policy/docs/CI wiring did not mention the repo-guard PR gate.

After the change, the validator passes and the staged diff passes repo-guard in blocking mode with the contract above.

Verification

• node scripts/validate-repo-guard-workflow.js
• node scripts/validate-requirements.js
• node scripts/validate-docs-headings.js
• bash experiments/test-validation.sh
• bash experiments/test-docs-headings-validation.sh
• node /tmp/repo-guard/src/repo-guard.mjs --repo-root .
• node /tmp/repo-guard/src/repo-guard.mjs --repo-root . --enforcement blocking check-diff --contract /tmp/pjson-repo-guard-contract.json --format summary
• node /tmp/repo-guard/src/repo-guard.mjs --repo-root . doctor (local-only warning: GITHUB_EVENT_PATH is not set outside GitHub Actions)
• Workflow YAML and PR template contract parsed with the yaml package

[konard]

Solution summary

Implemented and pushed the fix to issue-17-263cc7dd79fc.

PR: #21

What changed:

• Added repo-guard.yml to run netkeep80/repo-guard on PRs in check-pr mode with fetch-depth: 0, PR/issue read permissions, GH_TOKEN, and blocking enforcement.
• Added validate-repo-guard-workflow.js to catch missing or drifted repo-guard workflow/policy/template wiring.
• Updated the existing requirements workflow to run that validator.
• Documented the PR contract and anchors.affects / anchors.implements / anchors.verifies usage in README.md and the PR template.
• Removed the placeholder .gitkeep.
• Updated PR 21 title/body, added a valid repo-guard-yaml contract, and marked it ready for review.

Verification passed:

• node scripts/validate-repo-guard-workflow.js
• node scripts/validate-requirements.js
• node scripts/validate-docs-headings.js
• bash experiments/test-validation.sh
• bash experiments/test-docs-headings-validation.sh
• Local repo-guard policy validation and blocking check-diff
• YAML parsing for both workflow files and the PR template contract

Latest PR checks are passing:

• repo-guard policy check: https://github.com/netkeep80/pjson/actions/runs/24640255857
• requirements validation: https://github.com/netkeep80/pjson/actions/runs/24640242955

Working tree is clean and the branch is up to date with origin/issue-17-263cc7dd79fc.

Suggested follow-ups:

1. Add a release tag in netkeep80/repo-guard so pjson can pin netkeep80/repo-guard@vX.Y.Z instead of a commit SHA.
2. After a few PRs, review whether blocking mode is too strict or whether the initial budgets should be tightened further.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.4
• Provider: OpenAI
• Public pricing estimate: $2.834978

📊 Context and tokens usage:

• 3.6M / 1.1M (341%) input tokens, 28.4K / 128K (22%) output tokens

Total: (90.7K + 3.5M cached) input tokens, 28.4K output tokens, $2.834978 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.4
• Model: GPT-5.4 (gpt-5.4)

📎 Log file uploaded as Repository (28987KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

✅ Ready to merge

This pull request is now ready to be merged:

• All CI checks have passed
• No merge conflicts
• No pending changes

---

Monitored by hive-mind with --auto-restart-until-mergeable flag