Sync pjson with repo-guard governance trust model

[konard]

Summary

Addresses #24.
Fixes #26.

This PR syncs pjson with the latest repo-guard governance trust model:

• pins both repo-guard workflow uses to 99bf716da62c5d01070aa0d7e4d4f8031b43a351
• adds .github/ISSUE_TEMPLATE/change-contract.yml as the trusted issue channel for governance authorization
• extends repo-policy.json and scripts/validate-repo-guard-workflow.js to validate the new rollout wiring
• updates the PR template and docs to state that PR body is change intent, while authorized_governance_paths is trusted only from linked issue body

Issue #26 is the single-contract trusted authorization issue for this rollout. Issue #24 contains the product requirements and is referenced as the primary implementation target.

Tests

• node scripts/validate-requirements.js
• node scripts/validate-repo-guard-workflow.js
• local repo-guard check-pr simulation against this branch with linked issue Authorize governance rollout for issue 24 #26 authorization: passed

Change Contract

change_type: feature
scope:
  - repo-policy.json
  - .github/
  - README.md
  - docs/
  - requirements/README.md
  - scripts/validate-repo-guard-workflow.js
budgets:
  max_new_files: 2
  max_new_docs: 1
  max_net_added_lines: 300
anchors:
  affects:
    - FR-006
  implements:
    - FR-006
  verifies:
    - FR-006
must_touch:
  - repo-policy.json
  - .github/workflows/repo-guard.yml
  - .github/workflows/requirements.yml
  - scripts/validate-repo-guard-workflow.js
must_not_touch: []
expected_effects:
  - pjson uses the latest repo-guard governance trust model instead of the older rollout wiring
  - governance edits are authorized only from linked issue body via authorized_governance_paths
  - repo-guard rollout validation checks the new trust-model wiring across workflow, templates, policy, and docs
  - requirements-aware repo-guard policy remains intact and blocking

Related to #24

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.4
• Provider: OpenAI
• Public pricing estimate: $5.056694

📊 Context and tokens usage:

• 7.3M / 1.1M (699%) input tokens, 34.3K / 128K (27%) output tokens

Total: (136.7K + 7.2M cached) input tokens, 34.3K output tokens, $5.056694 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.4
• Model: GPT-5.4 (gpt-5.4)

📎 Log file uploaded as Repository (37592KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

🔄 Auto-restart triggered (iteration 1)

Reason: CI failures detected

Starting new session to address the issues.

---

Auto-restart-until-mergeable mode is active. Will continue until PR becomes mergeable.

[konard]

🔄 Auto-restart-until-mergeable Log (iteration 1)

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.4
• Provider: OpenAI
• Public pricing estimate: $1.841955
• Token usage: 144,406 input, 15,533 output, 1,540,864 cache read

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.4
• Model: GPT-5.4 (gpt-5.4)

📎 Log file uploaded as Repository (50428KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.