chore(security): establish public repository boundary

[allenwoods]

Summary

• add a trusted default-branch public-boundary workflow that scans candidate trees, outgoing history, ref names, path metadata, commit metadata, IPv4/IPv6 addresses, opaque files, and guard integrity without executing candidate code
• install a commit-versioned pre-push hook outside mutable worktrees
• add CODEOWNERS, security guidance, the canonical HackForger development skill, and PR boundary checks
• add a business-neutral, manifest-driven content publisher with atomic activation, authoritative backups, provenance verification, rollback, and local fixture coverage

Why this is a dedicated bootstrap

The boundary guard protects its own workflows, policy, tests, hook sources, skill, and CODEOWNERS. These files must not share an ordinary application or content migration PR.

The base branch does not yet contain the trusted workflow, so this first bootstrap cannot validate itself through the future required status. Merge requires a recorded security-owner/admin bypass after review. The required Public repository boundary status must only be enabled after the workflow is present on the protected base and a real candidate PR proves the status on the candidate head SHA.

The branch/tag push job is advisory because a public push has already disclosed its objects. Preventing first disclosure depends on the installed trusted pre-push snapshot and operator discipline. A stronger adversarial boundary for untrusted write collaborators requires an independent status-writing GitHub App or an organization-enforced required workflow.

Verification

• python3 -m unittest discover -s scripts/ci -p 'test_*.py' -q — 52 tests passed
• bash deploy/content/tests/run.sh — 24 tests passed
• shell syntax checks passed
• workflow YAML parsing passed
• Python compilation passed
• git diff --cached --check passed
• focused HackForger Go tests passed
• independent P0/P1 review found no unresolved code-level findings

Follow-up

A separate migration PR will preserve instance-specific material in the confirmed private repository, remove it from the public tip, and prove the complete boundary scan before server-side rules are made mandatory. No production deployment is part of this bootstrap.