Governance, workflow tags, and the prerelease shape

[lessevv]

Three related changes to the rules the organisation enforces, ahead of the
product repository adopting them.

AI disclosure is dropped

An AI is a tool. A pull request is judged on whether it satisfies the
requirement it cites, passes the gates, and is code somebody can maintain —
none of which is a fact about what produced it. The rule was also
unenforceable, so the field it produced meant nothing either way.

GOV-R24 is removed and the two identifiers after it are renumbered. That
contradicts GOV-R8/GOV-R10, which say identifiers are never renumbered —
a deliberate one-off, taken while nothing outside this repository cited them,
and not a precedent.

Shared workflows move to a major-version tag

ADR-0012 said first-party reusables are called on @main. The organisation
never did it: this repository and the website pinned to commits while the
product repository used @main. Three repositories, two behaviours, and a rule
contradicted in the tree.

ADR-0021 records the resolution and supersedes only ADR-0012's second rule —
full-SHA pinning for third-party actions is untouched. v1 moves forward as
fixes merge, so propagation is unchanged; a breaking change to a calling
interface cuts v2 so consumers migrate deliberately. Every move is also an
immutable v1.x.y tag.

This is not the mutable-tag attack ADR-0012 warned about, and the record says
why rather than assuming it: there the tag mover is a third party; here it is
this protected repository, and anyone who can move v1 can already push to
main, which @main would have executed anyway.

Any prerelease identifier is a preview tag

The tag table named two shapes while the pipeline has always keyed on a hyphen
anywhere in the ref name. -beta and -develop already worked; the
specification described a narrower system than the one that exists. Widened,
because a snapshot off the integration branch is a legitimate preview and
making it call itself a release candidate would make the label lie.

ADR-0019 is untouched — its decision is unchanged, only its examples were
narrow.

After merge

This PR must merge and be tagged before the beatrax and website PRs can go
green — their callers already reference @v1.

git tag -s v1.0.0 -m "shared workflows v1.0.0"
git tag -s v1     -m "shared workflows v1 → v1.0.0"
git push origin v1.0.0 && git push origin v1

spec integrity: clean.