ci: enforce governance contract

[AlexStocks]

Tracking

• Tracking issue: epic: align PowerContext Go with current PowerContext behavior and CI contracts #3
• Relationship: Part of #3 (WP0-B)

Summary

• add a repository governance checker for the Go 1.27 support declaration, CONTRIBUTING requirements, pull request contract, Issue form structure, required fields, and blank-issue policy
• validate the current bug_report.yml, bounded feature_request.yml, and compatibility-sensitive proposal.yml routes against the current GitHub Issue Form schema
• accept valid dropdown syntax and reject missing labels, missing markdown values, invalid IDs, duplicate dropdown options, optional required fields, and required fields using the wrong control type
• add a stable governance-contract CI job using the local Go toolchain and readonly module resolution
• promote the already-pinned YAML parser from an indirect to a direct tool dependency
• sync the latest codex/wp0-contributing base while preserving its Issue routes, CodeQL workflow, native build dependencies, and learned engineering rules

Problem and rationale

WP0-B in #3 requires contribution contracts to be machine checked rather than trusted as static text. The original checker shared an incomplete Issue Form model with its tests: it accepted forms GitHub could not render and rejected valid dropdown options. The stacked base later split bounded features from contract/platform proposals, so the checker now validates both routes and their required control types.

Behavior, API, and compatibility

• no runtime, public API, protocol, persistence, or generated-contract changes
• the new job fails on unsupported Go policy drift, missing contribution/PR requirements, malformed or duplicate Issue form fields, weakened required controls, optional evidence fields, or re-enabled blank issues
• explicit non-goal: repository settings and branch protection remain unchanged

Generated, dependency, and workflow impact

• no generated contract changed
• gopkg.in/yaml.v2 remains at the existing pinned version and is promoted from indirect to direct because the new tool imports it
• master.yml gains the stable governance-contract job; the latest base's CodeQL and native SQLite dependency behavior is preserved
• no credential, private Source/Memory content, or unredacted production log is included

Validation

Local Windows checks on exact Head 764ac0426cd568c789f8d7bd7cf669c2efe4b371:

• go test ./tools/governance-check -count=1 -v — 12 governance scenarios passed
• go test -race ./tools/governance-check -count=1 — passed
• go run ./tools/governance-check — passed against the real repository
• go mod verify — all modules verified
• pinned golangci-lint on ./tools/governance-check — 0 issues
• pinned formatter diff for both governance-check Go files — clean
• focused workflow contract tests unaffected by line endings — passed
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 — passed
• git diff --check and unmerged-index check — clean

The full Windows go test ./..., make lint, and make check remain unavailable as passing claims because the unchanged Base reproduces CGO/sqlite-header, symlink privilege, Unix mode, Windows URI, frozen LF hash, and CRLF go.sum comparison failures. Those failures were reproduced on unmodified Heads and were not changed in this PR.

Remote exact-Head evidence:

• all 27 GitHub checks succeeded, including CodeQL, governance-contract, lint, quality, coverage, unit/E2E acceptance, race/fuzz/module integrity, Frozen Python Oracle, OceanBase live compatibility, host adapters, real Docker build, and all Standard/Full linux/darwin architecture jobs

AI usage

Implemented with Codex assistance. The Issue Form assumptions were checked against the current official GitHub Docs source. Regression tests were run red/green against the real checker, the dropdown duplicate test received an additional discriminative mutant check, the latest stacked base was merged with semantic conflict inspection, and the final exact Head was verified locally and by the complete remote matrix.