security: restrict privileged governance dispatches - #17

Summary

Harden the privileged governance workflow and its merge/update path.

• reject manually-dispatched privileged jobs outside main;
• keep the organization-wide GitHub App token limited to discovery;
• keep reconciliation tokens repository-scoped;
• require DCO, actionlint and zizmor for changes to the .github repository;
• keep Dependabot grouping for minor/patch updates while isolating major upgrades;
• retain full immutable SHA pins for third-party Actions.

The ruleset-sync environment should also be configured in GitHub with deployment-branch restrictions to main and required reviewers where the plan supports it.