feat(governance): verify private mirror provenance

[monkseekee-max]

Outcome

Adds a read-only required gate for HMG-DEV-brach exact-source mirror pull requests. The gate verifies an Ed25519 receipt issued from protected HMG main and requires the signed source tree, signed export tree, and actual pull-request tree to be identical.

No HMG source-read or target-write credential is exposed to the target repository. Merge-group events fail closed until their provenance semantics are specified.

Validation

• python3 -m unittest discover -s governance/private-source-mirror -p test_*.py (13 passed)
• bash governance/workflow-policy/test.sh (41 passed)
• actionlint .github/workflows/required-quality-gate.yml
• workflow policy over origin/main..HEAD (0 violations)
• central commitlint over origin/main..HEAD (0 problems)
• git diff --check

Follow-up

After merge, HMG will pin this exact governance commit in its protected-main provenance issuer, and the HMG-DEV-brach ruleset will be updated to the same immutable required-workflow SHA.

[monkseekee-max]

@xionghaoh Independent Core Maintainer review is the remaining merge condition. All central checks are green. HMG source authority PR #55 has merged at 491bd7b1dd343fed740e1ce22f374bc129135068 with audited tree 0d3828666561bb79cbb8628464079e98b8924286; the target receives only this verifier/public key and a signed receipt, never an HMG read credential or signing secret. Please review the immutable verifier/workflow boundary when available; auto-merge is already configured and no bypass will be used.