Adopt selected proportional-governance path in CLI

[rcs2153]

Summary

• route the manifest-controlled authoritative CLI run path through the selected source-backed project-validation report adapter
• route aggregate and authored approve gates through one Core-owned approval envelope
• preserve existing commands, activation, human/JSON output, event ordering, retry posture, ordinary workflow behavior, and artifact obligations
• add a focused two-gate JSON/receipt regression test
• record the governed implementation and focused maintainer review

Governance

Implementation:

• workflow: dg/implement
• run: run-1786510854166490000-2
• approval: approval/run-1786510854166490000-2/implementation-approved
• outcome: granted with persisted presentation proof
• close: 39 events, 1 approval, 0 retries, 0 escalations

Review:

• workflow: dg/review
• run: run-1786511665299227000-2
• approval: approval/run-1786511665299227000-2/review-scope-approved
• verdict: accepted with non-blocking follow-ups
• close: 39 events, 1 approval, 0 retries, 0 escalations

Validation

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test -p workflow-cli --test cli authoritative_governance
• focused selected-envelope CLI regression
• cargo test --workspace
• npm run check:docs
• git diff --check

Non-goals

No new commands, flags, schemas, provider execution, provider writes, SideEffect execution, hosted behavior, runtime defaults, or mutation families.