ci: support GitHub squash merge history

[tsubotti63]

Summary

• accept the confirmed GitHub squash/Web merge committer
  GitHub <noreply@github.com> without widening the approved author policy
• allow public refs/remotes/origin/* while continuing to reject non-origin
  remotes, non-main local branches, unsafe namespaces, and sensitive ref names
• validate identities, commit messages, and paths across every commit reachable
  from public refs, while retaining the all-object privacy and credential scan
• add focused policy and regression tests
• run the existing bootstrap-ci job on pull requests using the PR head SHA

Failure being recovered

• Workflow run: 30139161784
• Job: test
• Failed step: python scripts/validate_public_history.py --ci
• Findings:
  • GitHub squash commit abe0281b2e8a713ad1b4bb44aa6adcca2b0f6445
    had approved author tsubotti63 and confirmed committer
    GitHub <noreply@github.com>, but the old policy required them to be equal
  • the normal full-history checkout contained the public remote-tracking ref
    refs/remotes/origin/agent/public-docs-evidence-alignment, but the old
    policy only allowed the three required refs and tags

Identity policy

Before:

• author and committer had to be identical for every reachable commit
• one four-field identity tuple had to be identical across the entire history

After:

• author email must still match the existing approved GitHub noreply policy
• author name/email remains the consistency authority across public history
• committer must either equal the author exactly or match the single confirmed
  GitHub committer tuple GitHub <noreply@github.com>
• unknown committers and differing author identities still fail closed

Ref policy

Before:

• CI allowed only main, origin/main, origin/HEAD, and tags

After:

• the same three refs remain required
• tags and refs/remotes/origin/* are allowed
• non-main local branches, non-origin remote refs, extra remotes, unexpected
  namespaces, and ref names with private/internal markers still fail
• HEAD, main, origin/main, and origin/HEAD -> origin/main alignment is
  unchanged

Security boundaries preserved

• approved author identity enforcement
• narrow committer allowlist
• origin-only remote enforcement
• shallow clone rejection
• sanitized-base ancestor checks
• commit-message and file-path scanning
• UUID, email, host-path, credential, internal project, private phase/source,
  and private workflow-status scanning
• all-object scan through git cat-file --batch-all-objects
• required main/origin ref alignment and tag support

Remote feature branches do not reduce object coverage. Commit identity, message,
and path checks now use git rev-list --all, and blob/commit/tag privacy scans
continue to inspect every local Git object, including unreachable objects.

Tests added

Eighteen focused tests cover:

• approved author=committer
• confirmed GitHub committer
• unknown committer
• unapproved and inconsistent authors
• required refs, origin feature refs, and tags
• rejected local feature and upstream refs
• sensitive ref names and missing required refs
• the PR docs: align public documentation with v1.1.1 evidence #1 squash metadata
• feature-branch author enforcement
• existing credential, host-path, and internal-name scans
• shallow history and missing sanitized-base ancestry
• pull-request workflow checkout of the PR head SHA

Local / Work validation

• Bootstrap Validation: PASS
• Platform Alignment: PASS
• Static Policy: PASS
• current GitHub full-history/main-equivalent Public History Validator: PASS
  • 41 reachable public-ref commits
  • 10 refs
  • 502 objects scanned
• clean PR-head/full-history Public History Validator: PASS
  • 42 reachable public-ref commits
  • 11 refs
  • 506 objects scanned
• pytest: 127 passed
• wheel and sdist build: PASS
• Twine strict metadata/README check: PASS
• isolated wheel install and version check: PASS
• isolated sdist install and version check: PASS
• git diff --check: PASS

PR-trigger strategy

Option A is used. The existing bootstrap-ci job now runs on pull requests to
main. Checkout uses the PR head SHA instead of GitHub's synthetic test merge
commit, then the existing ref-normalization step creates the same validator
contract used on a main push. No broader PR Quality Gate redesign is included.

Deferred items

• Node.js 20 deprecation warning: DEFER. It is independent of the failed
  validator step; changing action majors is intentionally outside this P0 fix.
• GitHub Release v1.1.1 candidate wording: DEFER. It is external release
  text and is not mixed into this repository code change.

Known residual risks

• GitHub may change its generated committer identity in the future. Such a
  change will fail closed until explicitly reviewed and allowlisted.
• PR verification checks the PR head plus current public refs, not GitHub's
  temporary synthetic merge commit. The branch is based on current main; the
  final main-push run remains the authoritative post-merge check.

Rollback

Revert the single commit from this PR. That restores the prior validator and
push-only workflow without changing product data, output contracts, tags,
releases, or package publication.