Harden pre-open review and hygiene evidence integrity

[Wibias]

Summary

Hardens the two evidence-integrity defects reproduced in the Grok commit + PR trace:

• candidate-wide bug: clean / security: clean declarations can no longer mint every required pre-open review row; each required lens/surface now needs explicit head-bound evidence with required file coverage;
• caller-authored hygiene skip text can no longer manufacture an authoritative user opt-out. Skipped publication hygiene fails closed until trusted controller/host user-intent provenance exists.

Regression evidence

RED-first coverage reproduced both trust-boundary gaps before the production changes. The final implementation also reconciles the workflow documentation and keeps create-pr-for-issue.md inside its enforced token budget.

Verification

Exact head: 246ee37682adab9be2063728302aad57aa6cc431

• CI: success
• Dependency Review: success
• Windows trace bins: success
• CodeQL: success

Scope

Evidence integrity only. Publication reliability, controller state grounding, and trace diagnostics are isolated in #435, #436, and #437.

Ready for review. Do not merge without explicit instruction.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: b2368839-f9b7-4ccd-828d-de4173b145f0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}