Add the governance gate; move to the shared workflow tag

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# GENERATED from beatrax-app/spec 70-operations/maintainers.toml — do not edit by hand.
+# Regenerate: python3 scripts/gen_codeowners.py <repo>
+
+* @lessevv
+

.github/labeler.yml

@@ -0,0 +1,22 @@
+# Area labels applied by the reusable auto-labeler, by changed path. The labels
+# are the canonical set in the spec (70-operations/labels.yml); this file only
+# maps this repo's paths onto them.
+documentation:
+  - changed-files:
+      - any-glob-to-any-file: ['**/*.md']
+
+ci:
+  - changed-files:
+      - any-glob-to-any-file: ['.github/**', 'astro.config.mjs', 'tsconfig.json', 'scripts/**']
+
+dependencies:
+  - changed-files:
+      - any-glob-to-any-file: ['package.json', 'package-lock.json', 'renovate.json']
+
+brand:
+  - changed-files:
+      - any-glob-to-any-file: ['src/styles/**', 'public/**', 'src/layouts/**']
+
+area:ux:
+  - changed-files:
+      - any-glob-to-any-file: ['src/components/**', 'src/pages/**']

.github/workflows/ci.yml

@@ -35,7 +35,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
 
       - run: npm ci

.github/workflows/deploy.yml

@@ -44,7 +44,7 @@ jobs:
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
 
       - run: npm ci

.github/workflows/labels.yml

@@ -12,4 +12,4 @@ jobs:
     permissions:
       contents: read
       issues: write
-    uses: beatrax-app/spec/.github/workflows/label-sync.yml@97e2ad2930e8d5d0baca83a9e8f45cf710215b8d # main
+    uses: beatrax-app/spec/.github/workflows/label-sync.yml@v1

.github/workflows/shared.yml

@@ -1,25 +1,34 @@
 # Calls the reusable workflows the spec repo defines once for the whole
-# organisation (Q-R20). Pinned to a commit for the same reason the
-# third-party actions are: a branch reference can be repointed without this
-# file changing.
+# organisation (Q-R20). Referenced by major-version tag: `v1` moves forward as
+# fixes merge there, so a shared fix still propagates in one merge, but a
+# breaking change cuts `v2` and this repo migrates deliberately (ADR-0021).
 name: shared
 on: [pull_request]
 permissions:
   contents: read
 
 jobs:
+  # The governance gate: a citation is present and every cited identifier
+  # resolves on the canonical spec (REPO-R1).
+  spec-check:
+    uses: beatrax-app/spec/.github/workflows/spec-check.yml@v1
   hygiene:
-    uses: beatrax-app/spec/.github/workflows/hygiene.yml@97e2ad2930e8d5d0baca83a9e8f45cf710215b8d # main
+    uses: beatrax-app/spec/.github/workflows/hygiene.yml@v1
   security:
-    uses: beatrax-app/spec/.github/workflows/security.yml@97e2ad2930e8d5d0baca83a9e8f45cf710215b8d # main
+    uses: beatrax-app/spec/.github/workflows/security.yml@v1
   dco:
-    uses: beatrax-app/spec/.github/workflows/dco.yml@97e2ad2930e8d5d0baca83a9e8f45cf710215b8d # main
+    uses: beatrax-app/spec/.github/workflows/dco.yml@v1
   commitlint:
-    uses: beatrax-app/spec/.github/workflows/commitlint.yml@97e2ad2930e8d5d0baca83a9e8f45cf710215b8d # main
+    uses: beatrax-app/spec/.github/workflows/commitlint.yml@v1
+  # Skipped for fork PRs, whose token cannot write a comment.
   spec-references:
-    uses: beatrax-app/spec/.github/workflows/spec-references.yml@97e2ad2930e8d5d0baca83a9e8f45cf710215b8d # main
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      contents: read
+      pull-requests: write
+    uses: beatrax-app/spec/.github/workflows/spec-references.yml@v1
   labeler:
     permissions:
       contents: read
       pull-requests: write
-    uses: beatrax-app/spec/.github/workflows/labeler.yml@97e2ad2930e8d5d0baca83a9e8f45cf710215b8d # main
+    uses: beatrax-app/spec/.github/workflows/labeler.yml@v1

.github/workflows/stale.yml

@@ -12,4 +12,4 @@ jobs:
       contents: read
       issues: write
       pull-requests: write
-    uses: beatrax-app/spec/.github/workflows/stale.yml@97e2ad2930e8d5d0baca83a9e8f45cf710215b8d # main
+    uses: beatrax-app/spec/.github/workflows/stale.yml@v1

.nvmrc

@@ -1 +1 @@
-20
+22