[docs] Bootstrap the hardened OB1 Review gate

[Humestone]

Purpose

This is the one-time gate bootstrap for Humestone/OB1. It is deliberately separate from draft PR #5 and must not be merged without explicit Stone/James approval.

What changed

• reconciles .github/workflows/ob1-gate-v2.yml from the current upstream architecture with the surviving HumeStone hardening
• preserves pull_request_target, ready_for_review / converted_to_draft, and workflow_dispatch event guards
• installs the metadata validator from trusted runner temp before the untrusted checkout and keeps safe Python path handling afterward
• disables checkout credential persistence and rejects any retained authorization header
• rejects symlinks, gitlinks, control-character paths, and path escapes before content inspection
• fetches full base history, verifies the merge base, and fails closed with no HEAD~1 fallback
• classifies docs/governance from changed files only while always running credential and binary scans
• validates metadata with the trusted base-branch schema, not a PR-modified schema
• replaces attacker-influenced multiline outputs with compact JSON and single-line base64
• builds the gate artifact outside the PR checkout and uploads it only after successful context production; a legitimate blocking review still uploads before the final gate failure
• preserves Rule 6 zero-count handling and names the exact future branch-rule context: OB1 Review

Trust boundary

The gate workflow has read-only contents permission, receives no secrets, and never executes PR-controlled repository code. The checked-out PR tree is inspected strictly as data after the early non-regular-file/path guard.

Privileged pull_request_target follow-ups are deliberately disabled and deferred to a separate future security-reviewed PR. .github/workflows/ob1-pr-followups.yml exactly matches humestone/main: its write-capable job accepts only workflow_run.event == 'pull_request'. Therefore this target-event bootstrap cannot trigger comments, labels, Claude auto-review, repository secrets, or OIDC. The existing pull-request-only follow-up remains dormant compatibility.

Validation

• unfiltered actionlint passed for the changed gate workflow
• paired workflow validation passed with only the unchanged base file's two pre-existing SC2129 style findings ignored
• git diff --check passed
• focused adversarial suite passed for trusted setup, malicious sitecustomize.py / local pip shadowing, checkout authorization headers, symlinks, gitlinks, multi-commit diffs, missing merge bases, forged delimiters, control-character and shell-shaped filenames, leading-dash option injection across credential/binary/SQL/local-MCP scanners, hostile titles, docs-only credential/binary blocking, Rule 6 empty counts, draft transitions, trusted base-schema use, typed artifact JSON, early-failure upload behavior, and PR-planted artifact poisoning
• independent read-only security review found no blocker
• final PR net scope is exactly .github/workflows/ob1-gate-v2.yml; the paired follow-up blob is identical to humestone/main

Merge boundary

Do not merge this draft without explicit Stone/James approval. This PR does not modify, rebase, or resolve PR #5; it creates no branch protection/ruleset, deploy, production configuration, schema/data, secret/access, or cleanup change.