ci(schema): require base-owned migration approvals

[shangguanxuan633-lab]

Summary

• build the authoritative Schema compatibility checker from the PR merge-base worktree, so candidate code cannot weaken its own checker
• add an exact, one-shot PAT interface migration approval covering the reviewed pat.batch_grant transition
• bind approval to canonical old/new interface and constraints snapshots
• fail closed on malformed, duplicate, unknown, partial, stale, retained, or symlinked approval state
• document the base-owned approval and consumption lifecycle

Why

The PAT CLI now has a composite flow:

• pat.batch_plan for authenticated read-only planning, including --all
• pat.batch_grant for confirmed writes
• pat.scope_revoke for safe single-scope revoke

That is an intentional contract migration from a direct MCP binding to a composite command. The migration must be approved by the merge-base rather than self-authorized by the product PR.

Scope

Exactly 5 governance files, one commit on current main. No runtime product code, release script, workflow, dependency, or unrelated constraint widening is included.

Verification

• final commit: 371862f0b3330f5d4fc0ee7c94ec4442784216b5
• final tree is byte-identical to the independently reviewed f9865654 candidate
• focused schema-compat tests: pass
• race: pass
• vet: pass
• shell syntax and diff check: pass
• make build: pass
• make policy: pass
• authoritative schema compatibility against upstream/main@e69a1084: pass
• changed executable coverage: 100.0% (421/421)
• independent qinze-style review: no P0/P1 in the technical change

Trust boundary / merge order

This PR intentionally changes scripts/policy/** and therefore requires real human ownership/adoption, CODEOWNER review, and explicit approval. It must not be self-approved or self-merged.

Merge order:

1. human-review and merge this governance PR
2. rebase the PAT product PR onto the new main
3. consume/delete the one-shot approval manifest in the product PR
4. run the full product CI and release validation

Supersedes #633, whose public head contains historical merge noise and an older technical revision.