chore: publish maintainer hardening and community evidence

[daichunghy]

Summary

This PR publishes a focused pre-release maintenance surface for PatchGate:

• move the Action metadata to the repository root and use the workflow token safely in shadow mode
• add pinned CodeQL and Dependabot configuration
• correct public owner, security and community links
• add seven hand-written Discussion prompts with a duplicate-safe schedule
• add an evidence review packet, application evidence index and six-month maintainer workflow draft
• add a consent-safe shadow pilot brief, G2 session record and structured pilot feedback template
• add a clean-room consumer fixture that verifies a full-SHA reference, bundle isolation and non-blocking merge-group handling
• add a release-candidate check and checklist for package, Action and CLI surfaces
• add a versioned branch-protection contract and a Rulesets subset for required checks and pull-request review controls
• fix live GitHub compatibility for .github/patchgate.yml, direct GraphQL Issue nodes and the GraphQL operation name
• make workflow-run evidence references unique per check name and stabilize process-heavy CLI tests on CI runners
• use the repository-scoped built-in GITHUB_TOKEN with discussions: write for the duplicate-safe community schedule; check:community-schedule verifies token, cadence, copy quality and duplicate guards

Evidence boundary

The changes document public maintenance, technical verification and recruitment work. They do not claim downstream adoption, independent community participation, a live external consumer, a release, a pilot or ChatGPT Pro eligibility.

Activation

Merge this PR into main before scheduled runs can start. The community workflow requests only contents: read and discussions: write through the repository-scoped built-in token. The Action remains non-blocking and the repository's required checks remain the authority.

Verification

• npm run verify passes locally: 94 non-CLI tests, 14 security tests, 25 GitHub integration tests, 5 CLI process tests, 7-post community schedule verifier, consumer fixture, release-candidate check, bundle clean-room verification and npm audit with 0 vulnerabilities
• required CI, CodeQL and Analyze checks pass on the current PR head
• authenticated live smoke against final public PR head ba36e6e reached GitHub through 24 GET requests (810858 bytes), built schema-valid EvaluationInput and ContributionReceipt, and returned human_review_required with no writes; receipt digest sha256:d37f09098519a56bdd1ba09f58bc931777c7e1e3896dc7176c1413a262bba030
• the live receipt explicitly reports the real missing linked issue, independent approval and applicable CODEOWNERS approvals; reviewability overruns remain advisory
• active Rulesets outside the supported required_status_checks/pull_request subset remain fail-closed rather than being guessed

Known transition boundary

The non-required PatchGate Review-Readiness Shadow Gate still fails on this PR because pull_request_target evaluates the workflow and local Action from the trusted base main, which still has the pre-migration .github/action.yml and does not yet expose the root action.yml. The PR branch contains the fix; this run cannot validate a change that is only available after merge. This is recorded as a transition limitation, not treated as a passing result or bypassed.

Merge-group membership, immutable last-pusher evidence, review-thread resolution and unsupported Ruleset semantics remain non-ready. No release or external pilot is claimed.

The PR is ready for independent review. Auto-merge is enabled for squash once the repository's required approval is provided.

Continuation update — 2026-08-22

• Added CI / Full Verify to the six strict required branch-protection contexts; the latest CI, Full Verify and CodeQL runs pass on the current head.
• Full Verify now covers the application form validator, community schedule, clean consumer fixture, release-candidate surface, CLI smoke and clean-room bundle. It also fixed two fresh-checkout defects: Action auto-run during imported tests and CLI build ordering before release validation.
• Corrected a CodeQL high-severity URL-substring validation alert in the application checker by requiring an exact official-form line.
• Added a copy-ready Codex for Open Source form draft with live evidence: public repository, main@a3745f6, open PR chore: publish maintainer hardening and community evidence #9, 0 stars/forks/tags/releases, and no claimed downstream usage or pilot.
• Discussion What is the first PR signal you check before opening a review? #10 is the first manually backfilled scheduled prompt; the remaining six prompts are staged for 2026-08-24 through 2026-09-03 at two-day intervals.

The PR remains open and mergeable but requires one independent approval. The non-required Shadow Gate still fails at the documented trusted-base transition boundary; it is not bypassed or counted as pilot evidence.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.