feat: add SHA-bound remote repository context acquisition

[Wibias]

What changed

• add scripts/repository-context.mjs to resolve owner/repo or GitHub URLs, discover the real default branch, optionally pin a workflow-selected branch, capture its exact commit SHA, and read files against that immutable SHA
• add references/repository-context.md with the remote-first acquisition ladder and explicit escalation rules for history, runtime, exhaustive analysis, and modification
• add GD-EVID-007 so workflows that already load the evidence policy can compose this capability without adding a new public route
• add focused unit/contract coverage for repository parsing, branch selection, SHA capture, exact-SHA reads, fail-closed behavior, and policy wiring

Why

GitHub Delivery sometimes needs repository context before a useful local checkout exists. The existing options either assume a checkout or encourage moving-branch/raw reads. This adds a bounded read-only path that keeps substantive evidence tied to an immutable snapshot and avoids guessing main, master, or HEAD.

The capability is intentionally internal. It does not add a new lifecycle route, mutation authority, or a required gitmcp dependency.

Validation

• node --test tests/unit/repository-context.test.mjs -> 8/8 pass in the isolated local mirror used for implementation
• node --check scripts/repository-context.mjs -> pass
• node --check tests/unit/repository-context.test.mjs -> pass

Full repository npm test / npm run check were not run locally because this execution environment cannot resolve GitHub to clone the repository. CI on this PR remains the authoritative full-repository validation.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 23c30be3-1c6d-48b4-9dc4-1a5f438be16e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}