chore: register Color Atlas and MD Porter governance

[tinkeragora]

What changed

• register Color Atlas and MD Porter in the production settings policy
• add both verified Alpha tools to the English and Chinese organization profile
• synchronize release automation, versioning, incident response, and access governance
• extend the production policy contract to all 21 public repositories

Why

New public repositories must be explicitly reviewed before the organization profile and governance policy claim them as supported. This keeps discovery information and security expectations aligned with the repositories that are actually published.

Operational verification

• Tinkora/md_porter now allows squash merge only
• Private Vulnerability Reporting is enabled for Tinkora/md_porter
• the post-change md_porter settings audit reports 52 PASS and 0 FAIL
• color_atlas has no current settings failures in the scoped audit

Validation

• scripts/check_all.sh
• 18 GitHub settings audit test runs with 953 assertions and no failures
• hosted Markdown, governance, and workflow static-analysis checks
• production settings policy manages all 21 public repositories