ci(governance): adopt the shared PR governance action

.github/governance/policy.json

@@ -0,0 +1,24 @@
+{
+  "version": "pr-governance/v3",
+  "mode": "enforce",
+  "reviewer": {
+    "provider": "codex",
+    "app_id": 1144995,
+    "user_id": 199175422,
+    "login": "chatgpt-codex-connector[bot]"
+  },
+  "r0_paths": [
+    "README.md",
+    "CHANGELOG.md",
+    "docs/prose/"
+  ],
+  "r2_paths": [
+    "scripts/",
+    ".github/governance/",
+    ".github/scripts/",
+    "policy.schema.json",
+    "policy.default.json"
+  ],
+  "dependabot_template_exemption": true,
+  "max_evidence_age_hours": 168
+}

.github/workflows/pr-review-signal.yml

@@ -0,0 +1,25 @@
+name: PR review signal
+
+# Copy to .github/workflows/pr-review-signal.yml and replace nothing: this
+# workflow holds no permissions and runs no repository code. It exists because a
+# review event on a fork or Dependabot pull request gets a read-only token, so
+# the gate that publishes statuses has to be started by `workflow_run` instead.
+# Keep the workflow name; risk-gate.yml refers to it.
+
+on:
+  pull_request_review:
+    types: [submitted, edited, dismissed]
+  pull_request_review_comment:
+    types: [created, edited, deleted]
+
+permissions:
+  contents: read
+
+jobs:
+  signal:
+    name: Signal review change
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Signal
+        run: echo "review event recorded"