feat(dogfood): bootstrap .charter governance to score 80/100 on own audit

[stackbilt-admin]

Summary

Charter now passes its own charter audit at 80/100 — meeting the ≥80 milestone gate for v0.13.

• 5 active patterns across 3 pattern files:
  • adf-patterns.json: ADF mutation review + manifest pointer integrity (GOVERNANCE)
  • oss-patterns.json: additive-only API contract + no-product-logic boundary (API/ARCHITECTURE)
  • testing-patterns.json: tests travel with public exports (TESTING)
• 100% policy coverage: governance-policy.md covers all 4 required audit sections — Commit Trailers, Change Classification, Exception Path, Escalation & Approval
• Trailer coverage is 0% on historical commits but resolves naturally as future commits adopt Governed-By: trailers (this commit is the first)

charter audit
Score: 80/100
Patterns: 5 active / 5 total
Policy coverage: 100% (4/4 sections matched)
Trailer coverage: 0% (historical — future commits will raise this)

Closes #159.

Test plan

• node packages/cli/dist/bin.js audit --format json | jq '.score.overall' returns 80
• node packages/cli/dist/bin.js audit --format json | jq '.patterns.active' returns 5
• node packages/cli/dist/bin.js audit --format json | jq '.policies.coveragePercent' returns 100
• All 4 policy sections matched: Commit Trailers, Change Classification, Exception Path, Escalation & Approval

🤖 Generated with Claude Code

[stackbilt-admin]

Review finding (blocking):

This PR currently fails Governance because adding .charter/patterns/*.json activates Drift Scan, and the workflow invokes:

• npx charter drift --ci --format text

In CI this errors with:

• npm error could not determine executable to run

So this branch is merge-blocked even though build-and-test is green.

Suggested fix direction:

• Use repo-local built CLI invocation in governance workflow (e.g. node packages/cli/dist/bin.js drift --ci --format text) or pnpm exec charter ... after ensuring the executable is resolvable in this repo context.

Once that invocation is corrected, this PR should be able to pass Governance consistently.

[stackbilt-admin]

Fixed in b1379fe. Replaced all npx charter calls in the governance job with node packages/cli/dist/bin.js — consistent with the scorecard job that was already using the local binary. All five governance steps updated (validate, drift, doctor, adf evidence, audit).

[stackbilt-admin]

Second fix in 78e0bb9: anti_patterns converted from arrays to strings in all three pattern files. drift/extractRules() calls .matchAll() on the raw field value — it requires a string. Confirmed locally: charter drift --ci --format json now reports 5 patterns scanned, 0 violations, no errors.