Fail closed on unrecognized maintenance paths

[0xprogrammable]

What changed

• allow only the exact new first-party issue and workflow files needed by the public surface update
• reject unknown workflow, script, submission, and vendor paths instead of classifying them as no-op
• cover both behaviors with regression tests

Verification

• npm test
• git diff --check

This is the small protected-base bootstrap required before the separate public-surface PR can pass public-intake.