Add the governance gate; move to the shared workflow tag

[lessevv]

Spec: REPO-R1, REPO-R5, REPO-R7, GOV-R12

The gate was missing

REPO-R1 requires every repository to call the shared governance gate. This one
called hygiene, security, sign-off, commit lint, the reference comment and the
labeler — but not the gate itself, so a change here could merge citing nothing.

Shared calls move to @v1

Per ADR-0021:
v1 moves forward as fixes merge in the spec repository, so a shared fix still
propagates in one merge, but a breaking change to a calling interface cuts v2
and this repository migrates deliberately rather than failing the moment
something lands there.

spec-references is now skipped for fork pull requests, whose token cannot
write the comment it exists to post.

CODEOWNERS

REPO-R5 requires an ownership file generated from the maintainer registry.
This repository had none, so no path had a declared owner and the triage
workflow's assignee lookup had nothing to read.

Pre-existing failures fixed

Turning the full gate on surfaced three failures that were already there:

• labeler had no .github/labeler.yml, so the action 404'd on every run.
• osv-scanner reports 19 known vulnerabilities in the pinned Astro version.
• typos findings in the site content.

Requires beatrax-app/spec#1, merged and tagged v1.

[github-actions]

📎 Spec references

This PR cites the following spec identifiers:

• REPO-R1 — Every repository MUST call the shared governance gate, and no behavioural change may merge without a citation that resolves on the canoni…
• REPO-R5 — Every repository's CODEOWNERS MUST be generated from the single maintainer registry and MUST NOT be edited by hand.
• REPO-R7 — Every third-party action MUST be pinned to a full commit hash with an inline version comment; first-party reusable workflows MUST be refe…
• GOV-R12 — Routine maintenance — dependencies, formatting, pipeline mechanics — MUST cite this identifier.

_{Updated automatically on each push.}