feat: add PR communication gate and fleet operations tooling

[bingb0t5]

Intent

Add the same fail-closed CEO-overview PR check Firstmate currently lacks, consuming the proven check pattern from mrbeanz-brains PR 11. Require What is changing, Why it matters, Customer or business impact, Risk and rollout, and the other Lalo-equivalent sections that fit this repo: Decision needed, Module-boundary decision, and Validation with Checks passed, Checks not run, and Evidence and limitations. Prove that a non-compliant description fails and a compliant description passes in real CI. Do not invent a weaker copy or add a forgotten secret that makes drift self-compare. Follow firstmate-coding-guidelines. Land on https://github.com/bingb0t5/firstmate. Use no-mistakes and never --yes. Preserve PR 5 automatic stow behavior alongside the fail-closed PR communication gate after merging the latest fork main. Resolve conflicts on their merits with a merge, not a rebase, and keep every accepted pipeline fix commit. Run one fresh validation pass on the merged head, including the fail-then-pass CEO-overview proof. The target PR on bingb0t5/firstmate must be conflict-free and green.

What Changed

• Add fail-closed PR communication workflows, a required CEO-focused template, and pinned source-of-truth drift verification for the vendored assessor.
• Add a Tailscale-bound fleet quota dashboard that serves live quota-axi provider status and reset windows.
• Add opt-in, interval-gated automatic /stow reminders with separate attempt and reset-safe markers.

Risk Assessment

✅ Low: The change preserves automatic stow behavior and implements a well-bounded fail-closed PR communication gate with trusted base-branch verification, pinned entrypoint and assessor checks, and behavioral coverage for compliant, non-compliant, drift, and remote-failure cases.

Testing

Focused PR-gate, session-start automatic-stow, and Pi integration tests passed on merged head 503b615; a fresh CLI exercise rejected an incomplete description with every missing requirement and accepted a complete one, while GitHub Actions runs 32720666105 and 32721072427 demonstrate the same fail-then-pass behavior in real CI. The worktree stayed clean; final PR #6 publication, conflict resolution visibility, and green checks belong to the outer push and CI phases.

Evidence: Target commit CLI fail-then-pass transcript

Source: Target commit CLI fail-then-pass transcript

Target commit: 503b615d0db7bf83630c7ff76f682ae1c92a8ccf

=== NON-COMPLIANT PR DESCRIPTION ===
Clarity check: The PR title is very short. State the user or business outcome.
Cannot enter staging until completed: CEO overview: Why it matters (no line found); CEO overview: Customer or business impact (no line found); CEO overview: Risk and rollout (no line found); Decision needed; Module-boundary decision; Validation: Checks passed (no line found); Validation: Checks not run (no line found); Validation: Evidence and limitations (no line found)
::error::Cannot enter staging until completed: CEO overview: Why it matters (no line found); CEO overview: Customer or business impact (no line found); CEO overview: Risk and rollout (no line found); Decision needed; Module-boundary decision; Validation: Checks passed (no line found); Validation: Checks not run (no line found); Validation: Evidence and limitations (no line found)
exit_code=1

=== COMPLIANT PR DESCRIPTION ===
PR communication is complete.
exit_code=0

=== REAL CI PROOF ON FORK PR #4 ===
Failing run: https://github.com/bingb0t5/firstmate/actions/runs/32720666105
Passing run: https://github.com/bingb0t5/firstmate/actions/runs/32721072427

- Evidence: [Real CI rejection of non-compliant PR description](https://github.com/bingb0t5/firstmate/actions/runs/32720666105) - Evidence: [Real CI acceptance of compliant PR description](https://github.com/bingb0t5/firstmate/actions/runs/32721072427)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• Inspected git diff 038d0f7ec6ba7238a151722931434dcf06ff37c4..503b615d0db7bf83630c7ff76f682ae1c92a8ccf and relevant commit history.
• bash tests/pr-communication.test.sh
• bash tests/fm-session-start.test.sh
• bash tests/fm-calm-pi-extension.test.sh
• Direct node --experimental-strip-types scripts/check-pr-communication.ts execution with non-compliant and compliant PR bodies on target commit 503b615d0db7bf83630c7ff76f682ae1c92a8ccf.
• gh-axi run view 32720666105 --repo=bingb0t5/firstmate --log-failed
• gh-axi run view 32721072427 --repo=bingb0t5/firstmate
• gh-axi pr view 6 --repo=bingb0t5/firstmate and gh-axi pr checks 6 --repo=bingb0t5/firstmate
• Verified fork main commit 8c74f4e5df2a6ba291b438926c00a9a056996c26 is an ancestor of the merge target and the worktree remained clean.

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

_{Reviews (7): Last reviewed commit: "Merge fork main preserving PR 5 and PR c..." | Re-trigger Greptile}