fix(authority): complete bootstrap hardening

[mindburnlabs]

Stack 2 of 6. Hardens the bootstrap proof, credential separation, and reviewer boundaries. Depends on #44; followed by #45, #42, #43, and #36.

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

[github-actions]

Docs Truth: missing_ledger_row — 1 file(s) need ledger rows

Tracked markdown in .github has no matching row in the org ledger
(Mindburn-Labs/docs/audit/markdown-estate-ledger.csv). This gate will stay
red on main after merge until the rows are added there.

Files that need ledger rows

• docs/adr/0002-autonomous-release-permit.md

Fix — open a small PR against Mindburn-Labs/docs

Append these rows to audit/markdown-estate-ledger.csv (schema: repo,path,status,owner,truth_kind,source_refs,truth_gate,public_surface,superseded_by,notes):

".github","docs/adr/0002-autonomous-release-permit.md","active",".github","repo_docs",".github:Makefile;.github:catalog-info.yaml;.github:agent.yaml;.github-repo:repo-manifest.yaml","","false","","initial docs-truth inventory row generated from tracked markdown; source_refs name owning repo evidence or gates"

Adjust source_refs if .github does not have all four of Makefile, catalog-info.yaml, agent.yaml, and the .github-repo:repo-manifest.yaml entry — grep neighboring .github, rows in the CSV to see the canonical set for this repo. Keep the new rows alphabetically ordered inside the .github, block.

Once the ledger PR merges, re-run this job (gh run rerun 29507223487 --repo Mindburn-Labs/.github --failed) to turn this gate green.

_{Auto-generated by Mindburn-Labs/.github/.github/workflows/docs-truth-public.yml. Longer-term refactor of the two-repo ledger flow is tracked in HELM-41.}