fix(governance): prove routing and CI controls

[notque]

Summary

Recover and finish the stashed routing and governance controls against current main.
Make generated routing data deterministic, prove hard CI gates can fail, and normalize cross-harness hook payloads without breaking live Agent results.

Changes

• scripts/generate-routing-map.py — generate and validate a tracked-only 43-agent, 101-skill, 28-pipeline routing map with fail-closed index handling.
• scripts/validate-negative-controls.py — inventory collected CLI-level failure proofs, reject false certifications, and provide a dated strict-mode promotion path.
• scripts/pre-route.py — route FORCE pipelines in their own slot while inheriting semantic guards from paired skills.
• hooks/lib/hook_utils.py — normalize string and mixed-schema tool payloads while preserving structured Agent content blocks.
• skills/** — remove or repair nine stale routing relationships exposed by the new map gate.
• scripts/tests/** and hooks/tests/** — add adversarial regressions and missing negative suites for governance checks.
• .github/workflows/test.yml — enforce routing-map freshness and run the negative-control inventory in advisory mode until its recorded debt is retired.

Notes

• High-risk change: 41 files and 2,995 changed lines; the owner explicitly authorized push, PR, CI remediation, and merge.
• The change is cohesive: all files support routing integrity, executable governance controls, or their regression evidence.
• Advisory negative-control enforcement graduates on 2026-10-01 by removing continue-on-error and switching to --strict after the 12 explicit debt entries are retired.
• Independent system, domain, and architecture reviews approve after two fix-and-retest iterations.

[github-actions]

Skill-eval coverage

Changed skills in this PR: 10 (1e439d42bd6d..6756cf93c660).

Report only. CI cannot run evals (the runner needs the claude CLI). Run the ablation locally to get the base->head delta.

Mapped

• do -> eval evals/new-skills-ab-test. Run locally: make skill-eval-ablation BASE=1e439d42bd6d HEAD=6756cf93c660 SKILL=do
• multi-persona-critique -> eval evals/new-skills-ab-test. Run locally: make skill-eval-ablation BASE=1e439d42bd6d HEAD=6756cf93c660 SKILL=multi-persona-critique

Uncovered

no eval coverage for changed skill(s): bluesky-reader, game-sprite-pipeline, marketing, phaser-gamedev, reddit-moderate, research-pipeline, shell-process-patterns, x-api
A gap to consider, not a failure.