build: consolidate merged WP0 stack onto main

[AlexStocks]

Tracking

• Tracking issue: epic: align PowerContext Go with current PowerContext behavior and CI contracts #3
• Relationship: Part of #3

Problem and rationale

PRs #28 through #32 were merged through an intermediate stacked branch chain, so their contribution, governance, workflow-hardening, Windows checkout, and strict Make contracts did not reach main. Merging the final stacked Head wholesale would also reintroduce portable and dependency-license implementations already superseded by #35 and #36. This PR applies only the missing net behavior onto the current main.

Changes

• Add contribution guidance, validated Issue forms, and the pull request template from docs: add contribution and review contracts #28.
• Add the governance contract checker and tests from ci: enforce governance contract #29.
• Add bounded workflow permissions, timeouts, and concurrency contracts from ci: require workflow timeouts and permissions #30.
• Add the Windows LF checkout and frozen-fixture contract from ci: verify Windows contract checkout #31.
• Add strict Bash/Make execution and machine-checked Make target behavior from build: enforce strict Makefile execution #32.
• Preserve the canonical ci: add CGO-disabled portable SDK cross-build gate #35 check-portable, ci: verify dependency license evidence #36 dependency-license evidence, and fix(deps): override vulnerable ansi-regex #38 dependency override.
• Exclude the duplicate ci: verify portable public SDK builds #34 portable job and superseded ci: verify dependency license evidence #37 license implementation.
• Extend LF rules to go.mod and go.sum after a fresh Windows checkout reproduced whole-file module diffs.
• Remove an integration-leftover test helper detected by the pinned lint policy.

Behavior and compatibility

• User-visible behavior: contributor and CI failure guidance becomes explicit and machine checked.
• Public API or protocol impact: none.
• Breaking changes or migration requirements: none for runtime consumers; repository workflows and Make targets become stricter.
• Explicit non-goals: no runtime, persistence, OpenAPI, portable-SDK, dependency-license, or dependency-override redesign.

Generated, dependency, and workflow impact

• No generated contract changed, or every required output was regenerated from its source.
• No dependency changed, or go.mod and go.sum are complete and verified.
• No CI or release contract changed, or stable job names, permissions, timeouts, and failure evidence were reviewed.
• No credential, private Source/Memory content, or unredacted production log is included.

Validation

Commands run against submitted Head 1a992ef8bbe0aed8205c74e2b71de92892d869ae in a fresh Windows checkout:

go mod tidy -diff
go mod verify
go test ./tools/governance-check -count=1
make governance-check
go test ./tools/release -count=1 -run 'Test(Makefile|Workflow|Windows|Portable|License|Governance)'
go vet ./tools/governance-check ./tools/release
golangci-lint v2.13.1 run ./tools/governance-check ./tools/release
go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
make check-generated
make check-portable
git diff --check
Windows LF/raw-byte and frozen fixture SHA-256 workflow-equivalent probe

All commands above passed; pinned lint reported 0 issues, and all four portable targets built successfully.

Native Windows cannot complete full-repository make check, make lint, or make license-dependencies because the existing SeekDB implementation includes loader.c while its CGO Go implementation is build-tagged for Linux/macOS. Exact-Head Linux CI is therefore required before merge.

• git diff --check
• git status --short was inspected after validation.
• Relevant generated, compatibility, workflow, and release checks were run.
• Any skipped or unavailable check is identified above and is not represented as passing.

AI usage

AI assistance was used to reconstruct the stacked PR topology, resolve the integration conflicts, add the LF regression coverage, and prepare the consolidation commit. The resulting Head was independently checked through fresh-checkout module, governance, workflow, generated-contract, portable-build, lint, and raw-byte verification described above.