[B2] Replace generic self-built governance checks with mature OSS

[SisyphusZheng]

Part of #1155 and #1192. Target: v0.44.0-beta.3.

Objective

After framework, UI, and website architecture stabilizes, replace generic repository-owned governance with pinned mature tools and delete duplicated custom machinery.

Scope

• Renovate for supported Deno/npm/JSR/GitHub Actions dependency updates
• Gitleaks and GitHub secret protection
• markdownlint-cli2 and lychee
• actionlint and zizmor
• CodeQL and OpenSSF Scorecard
• publint and Are The Types Wrong against packed artifacts
• CODEOWNERS, issue forms, PR templates, and generated release notes
• AutoFlow/checker inventory and deletion of generic duplicate authority

Acceptance

• Mature tools run reproducibly and fail CI non-zero for owned violations.
• Replaced custom implementation, tests, tasks, and workflow steps are removed in the same migration.
• Remaining repository-owned checks map to named OpenElement invariants.
• No duplicate generic authority remains.

Boundary

This issue does not block Alpha compiler/runtime work. Do not build wrapper frameworks, long-lived dual paths, or broad repository-owned equivalence suites around mature tools.

[SisyphusZheng]

[ADR-0146 CLAIM]

Loop: a0-002
Candidate: 0.44.0-alpha.0 internal integration baseline
Base SHA: 3563812351258ebde655326a60b2219f5c152e9c
Acceptance slice: CI evidence tiering and role-neutral documentation.
Dispatch: docs/evidence/v0.44.0-agent-loops/a0-002/dispatch.md

Reason for advancing this ready slice: it removes repeated full-matrix cost before the remaining train and makes all subsequent documentation inherit neutral role vocabulary. This slice does not claim full #1156 completion.

Preflight: orchestration check PASS; configured executor check PASS.
Owned paths: governance/tooling, role profiles, AutoFlow policy/tests, and docs only. Product/packages/examples/www/workflows are forbidden.

[SisyphusZheng]

a0-002 slice integrated into dev by exact-SHA fast-forward. Candidate: 0ae6585. PR: #1186. Authoritative AutoFlow CI: https://github.com/open-element/openelement/actions/runs/33142165035 (pull_request, attempt 1, success, exact head SHA). Artifact: pr-full-ci-evidence-0ae65853a8e807b1b31da8752b434167219d25d6 (unique, non-expired, schema v2, full matrix complete, production provenance verifier PASS). All PR checks passed, including CodeQL, external review, Cloudflare, dependency review, and both Node smoke jobs. Implementer GO and thinker GO were recorded; this internal alpha.0 slice requires no release-verifier publication closure. The prior SHA 2ab06b5 and run 33140997895 remain rejected. Alpha.0 was not tagged, published, released, assigned a dist-tag, promoted to main, or otherwise externally released. This closes only the CI evidence tiering and role-neutral documentation slice; #1156 remains open for its Renovate/tool offload and ownership deliverables.