v0.19.0 — measured evidence, approval attestation, and a verdict for autonomous runs

Three things a governed repo could previously only assert about itself, it can
now show: that a defect fix restores already-established behavior, that a
quality score was measured rather than predicted, and that an ADR was approved
by someone entitled to approve it. Plus govkit verdict, which asks the same
question of an autonomous agent's own run.

Upgrading: govkit upgrade refreshes the governed contracts, CI templates
and agent rules. Two things to know before you run it:

• The FIRST/Virtue threshold no longer fails a build — it WARNs. Those
  scores are written by the agent that did the work, so they are a forecast.
  If you relied on that as a merge gate, wire up evidence-gate.yml, which
  measures instead of predicting. Missing or self-contradictory values still
  fail.
• The eight shipped CI templates that install govkit now pin
  govkit~=0.19.0. upgrade rewrites them; copies you have already placed
  in .github/workflows/ are yours and are not touched.

New installs get governance/approval_policy.yaml holding a
YOUR_APPROVER_LOGIN sentinel. It is inert until you edit it, so a fresh
install stays green.

Added

• govkit verdict — for a harness driving an autonomous agent: may this
  run open a PR? An agent cannot answer that about itself and neither can its
  exit code, so the verdict is derived from the working tree, the diff and the
  gates. Four outcomes: 0 FIXED, 1 REJECTED, 2 REFUSED, 3 BLOCKED. A
  refusal is a success — coding it as failure invites a retry loop, and a
  retry loop against a gate the agent cannot honestly clear is what produces
  self-certification.
• ADR approval attestation. An ADR's Accepted status becomes a derived
  state rather than typed text. governance/approval_policy.yaml names which
  logins hold the Approver role; ci/{github,azure}/adr-approval-gate.yml
  requires an approving review from one of them, bound to the head commit, and
  fails closed when the policy names nobody. govkit validate covers the
  working-tree half. The governance rules had gated implementation on
  Accepted since L4 shipped, and nothing had ever read it.
• govkit evidence — reports what CI actually produced (test report, axe
  results) as a verdict per rubric dimension. Unmeasured dimensions report
  INCONCLUSIVE, which is not a pass: an unmeasured dimension is
  indistinguishable from a verified one.
• The defect lane. A change that restores already-established behavior
  carries one schema-backed record (fixes/<id>/fix.yaml via govkit fix init) instead of the five-artifact feature contract, with
  ci/*/fix-lane-gate.yml closing the code-only escape hatch.

Changed

• The adr-author skill writes Proposed and stops. It previously handed
  the agent the full status vocabulary, so nothing stopped it choosing the one
  status it cannot earn.
• The ADR templates' Approval section requests a decision rather than
  recording one. ## Status and ## Approval sat ~140 lines apart, unlinked,
  and Approval was three empty colon-terminated labels bound to no identity, no
  date and no commit.
• FIRST/Virtue prediction is advisory. See Upgrading above.

Fixed

• govkit upgrade no longer reverts your stack to the bundled baseline
  (#132). The six architecture docs that vary by stack live under a governed
  path, and upgrade re-installed governed contracts over them — so a Go, .NET,
  JVM or Node team's architecture contracts silently became Python/FastAPI ones
  on a routine upgrade, and the falsified baseline: header made doctor's D006
  stale-overlay check stop reporting for the life of the repo.
• govkit evidence reports only the dimensions that describe the project —
  a CLI or data project no longer sees accessibility scored against it.

Full detail in CHANGELOG.md.