docs(research): note chrome source priority order

[senih25]

Summary

• records the next safe application order for the Chrome article CSV
• routes the highest-risk work to UYAP and e-Nabız before Social Profile Assistant
• classifies the cross-repository ideas as manual-review or public-safe documentation patterns
• keeps the change docs-only and public-safe

Scope

• docs/research/CHROME_SOURCE_PRIORITY_FOR_SENSITIVE_REPOS.md

Safety boundary

This PR does not:

• modify runtime code
• access UYAP or e-Nabız data
• request PHI or exports
• add deployment commands
• add credentials, tokens, or private URLs

Validation

• git diff --check passed
• worktree clean after commit
• branch created from current main

[Copilot]

Pull request overview

Adds a research note documenting a “safe-first” priority order for applying Chrome extension/DevTools patterns across higher-risk sensitive repositories, while explicitly classifying cross-repo ideas and restating safety boundaries to keep the guidance public-safe and non-executable.

Changes:

• Adds a new doc defining the priority order (UYAP → e‑Nabız → Social Profile Assistant) with rationale.
• Records cross-repository classification (manual review vs public-safe documentation/checklist).
• Includes milestone-flow checklists and a repeated safety-boundary section to keep the guidance non-operational.

Changed files

• docs/research/CHROME_SOURCE_PRIORITY_FOR_SENSITIVE_REPOS.md

Risks

• The doc currently references chrome_articles_2026-07-01.csv, but that CSV is not present in this repository, which can confuse readers and hinder traceability of the “source library”.

Validation (from PR description)

• git diff --check passed
• worktree clean after commit
• branch created from current main

Safety boundary confirmation

• Change is docs-only (no runtime code changes, no integrations, no credentials).
• Document explicitly states no PHI, no exports, and no direct runtime coupling with sensitive repositories.

Manual review checklist (custom)

• Confirm the referenced Chrome article CSV is either present in-repo or explicitly documented as intentionally external (with a safe locator).
• Re-scan the doc for any private URLs/endpoints, credentials, or instructions enabling live data access (must not exist).
• Ensure cross-repo classification stays within the allowed categories and does not imply runtime coupling.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.