Issue 29: canonical governance source and safety checks

[DerekCorniello]

Local Derek-authored governance stack for issue 29. Adds the nine-repository manifest, canonical agent guidance, safe template/label synchronization, workflow pinning, security-policy wording, and profile accuracy. Live synchronization remains approval-gated.

[greptile-apps]

Greptile Summary

The PR establishes a canonical nine-repository governance manifest and adds guarded synchronization for shared labels, issue templates, workflows, and community documentation.

• Adds a reusable manifest loader and repository validation across governance tooling.
• Makes label and template synchronization dry-run by default and validates targets before mutation.
• Pins shared GitHub Actions and updates issue-triage, security, and organization-profile policy.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
scripts/repository_manifest.py	Introduces the canonical parser and exact nine-repository manifest validation.
scripts/sync-labels.sh	Adds dry-run/apply modes, canonical target loading, and preflight validation before live label mutations.
scripts/sync-templates.sh	Adds destination verification, staged installation, guarded rollback, and dry-run diff output.
scripts/validate-labels.py	Uses the canonical manifest and validates repository metadata before comparing live labels.
templates/shared/workflows/issue-triage.yml	Pins the workflow action and refines triage-label handling based on repository permissions.

_{Reviews (2): Last reviewed commit: "fix(governance): make template rollback ..." | Re-trigger Greptile}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud