ci(governance): adopt the shared PR governance action

.github/dot-review/review.cjs

@@ -142,7 +142,8 @@ async function select(github, context) {
   assert(run.workflow_id === workflow.id && workflow.path === '.github/workflows/risk-gate.yml'
     && workflow.name === 'PR risk gate' && run.status === 'completed'
     && run.repository.full_name === `${context.repo.owner}/${context.repo.repo}`, 'untrusted_upstream_workflow');
-  if (run.event === 'schedule') return null;
+  // A sweep and a relayed signal run carry no single pull request.
+  if (['schedule', 'workflow_run'].includes(run.event)) return null;
   assert(['pull_request_target','pull_request','workflow_dispatch'].includes(run.event), 'unsupported_upstream_event');
   const linked = [...new Set((run.pull_requests || []).map(p => p.number))];
   if (linked.length === 1) return linked[0];

.github/dot-review/test-review.cjs

@@ -70,7 +70,8 @@ test('failed upstream gate can select one PR; wrong workflows and ambiguous asso
   run.workflow_id=13;await assert.rejects(r.select(github,context));run.workflow_id=12;
   run.pull_requests=[{number:7},{number:8}];await assert.rejects(r.select(github,context));
   run.pull_requests=[];await assert.rejects(r.select(github,context));
-  run.event='schedule';assert.equal(await r.select(github,context),null);
+  for (const event of ['schedule','workflow_run']){run.event=event;
+    assert.equal(await r.select(github,context),null);}
 });
 
 for (const kind of ['premerge','posthoc']) for (const uncertain of [false,true]) test(kind + (uncertain ? ' uncertain' : '') + ': offline submit/collect keeps one task and never grants approval', async () => {

.github/governance/policy.json

@@ -0,0 +1,24 @@
+{
+  "version": "pr-governance/v3",
+  "mode": "enforce",
+  "reviewer": {
+    "provider": "codex",
+    "app_id": 1144995,
+    "user_id": 199175422,
+    "login": "chatgpt-codex-connector[bot]"
+  },
+  "r0_paths": [
+    "README.md",
+    "CHANGELOG.md",
+    "docs/prose/"
+  ],
+  "r2_paths": [
+    "scripts/",
+    ".github/governance/",
+    ".github/scripts/",
+    "policy.schema.json",
+    "policy.default.json"
+  ],
+  "dependabot_template_exemption": true,
+  "max_evidence_age_hours": 168
+}

.github/workflows/pr-review-signal.yml

@@ -0,0 +1,25 @@
+name: PR review signal
+
+# Copy to .github/workflows/pr-review-signal.yml and replace nothing: this
+# workflow holds no permissions and runs no repository code. It exists because a
+# review event on a fork or Dependabot pull request gets a read-only token, so
+# the gate that publishes statuses has to be started by `workflow_run` instead.
+# Keep the workflow name; risk-gate.yml refers to it.
+
+on:
+  pull_request_review:
+    types: [submitted, edited, dismissed]
+  pull_request_review_comment:
+    types: [created, edited, deleted]
+
+permissions:
+  contents: read
+
+jobs:
+  signal:
+    name: Signal review change
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Signal
+        run: echo "review event recorded"