docs(governance): adopt repository trust policy

[szmyty]

Summary

Adopt the organization-facing trust-policy contract required by #9 while preserving the agreed policy-first dependency direction.

This pull request:

• selects DCO 1.1 for human contribution attestation;
• defines correction, bot-exemption, fail-closed enforcement, and time-bounded exception behavior;
• defines cryptographic expectations for commits, tags, releases, containers, packages, and published document bundles;
• introduces four output-based repository classes (R0–R3);
• specifies digest-bound provenance and artifact-specific SBOM requirements by class;
• defines explicit legacy-unclassified, planned, piloting, enforcing, conformant, and retired migration states;
• prevents organization checks from blocking legacy repositories without a reviewed migration record;
• records the policy-first dependency decision in the repository architecture corpus; and
• adds the trust policy to the repository entry point.

Dependency resolution

This is the normative policy layer, not implementation evidence:

1. .github defines the policy first.
2. Relay 🧠 [platform] Configure organization-wide Copilot instructions #1 and 💰 [platform] Setup Patreon and integrate with GitHub funding #4 can implement reusable DCO, verification, signing, SBOM, provenance, and release profiles against it.
3. Realm feat(reflector): bootstrap pass-based organization discovery audit engine #7 can prove the R3 image requirements.
4. Empathy can prove the repository-local golden-consumer adoption contract.
5. Organization adoption evidence can then be recorded without reopening the policy decision.

Scope boundary

This pull request does not:

• add or copy reusable workflow YAML;
• change organization or repository branch-protection settings;
• mutate sibling repositories;
• add signing keys, credentials, or secret material;
• claim Relay, Realm, Empathy, or any legacy repository is already conformant; or
• make checks blocking before a repository records an explicit adoption state.

Validation

trust-policy acceptance structure complete
local Markdown links resolve
Markdown has no trailing whitespace
boundary scan clean: egohygiene/.github
git diff --check: clean

The branch contains one DCO-signed scoped commit over current main.

Review gates

• Confirm DCO enforcement and automated-contribution exemptions are sufficiently explicit.
• Confirm the six signing subjects have the right minimum expectations.
• Confirm the R0–R3 class matrix maps cleanly to Relay release profiles.
• Confirm legacy repositories cannot become blocking without explicit migration state.
• Confirm exception ownership, expiry, renewal, and break-glass behavior are acceptable.
• Confirm Relay, Realm, Empathy, Hygiene, and .github responsibilities remain separate.

Fixes #9

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 15⭐
  Check Your Progress