refactor(autoflow): shrink policy registry to OE-specific invariants (#1229 B2.7) - #1295

Closes #1229. Refs #1288 (stage), #1155 (umbrella), #1156 (B2.6 dependency, landed in #1294). ADR-0144 boundary, ADR-0151 train.

Problem

After #1294 adopted actionlint/zizmor/gitleaks/markdownlint-cli2 and deleted the bespoke type-safety/secret scanners, the AutoFlow policy registry (tools/autoflow/policy.ts) still carried pure pass-through gates for generic toolchain concerns — format, lint, type graph, Markdown structure — that ADR-0144 assigns to Deno fmt/lint/check and markdownlint-cli2. AutoFlow also carried a duplicated deno.json task alias. Per ADR-0144, AutoFlow may own only OE-specific semantics (changed-path selection for OE conformance suites, five-package lockstep, release ordering/evidence, architecture/compiler/SSR/consumer gates) and "must stop owning" generic machinery.

Owner

Single owner per concern after this PR — the pinned OSS tool itself, wired as a plain CI step and git-hook call, not a second authority inside the AutoFlow registry:

Per-deletion replacement table

No protection is silently dropped: each deleted gate's command still runs in the same CI job, earlier (fail-fast before the Playwright install), and locally in the hooks that previously reached it through the tier. The release lane is behaviorally unchanged: selectComplementaryReleaseGates already skipped every ci-tier gate at release, so the four deleted gates never replayed there.

Before / After

Why-not-second-owner

ADR-0144 already assigns these four concerns to Deno fmt/lint/check and markdownlint-cli2; keeping AutoFlow gates wrapping the same commands made AutoFlow a second owner of generic policy (the ADR-0144 boundary violation #1229 targets). Moving the calls to plain CI steps/hooks leaves exactly one authority per concern. Not moved further (e.g. deleting the typecheck/lint:markdown deno tasks): the tasks are the pinned, locally-runnable invocation both CI and hooks share — deleting them would duplicate the command strings, not policy.

Evidence

Local, on this branch (macOS, Deno workspace), exact commands and exit codes:

• RED first: new test policy: generic toolchain concerns are not AutoFlow gates (ADR-0144, #1229) + updated dev-tier assertion failed 2 tests before the policy edit; after the edit the autoflow suite is green — deno test --allow-read --allow-write --allow-env --allow-net --allow-run --allow-ffi --allow-sys tools/autoflow/__tests__/ → exit 0 (135 passed, 0 failed).
• deno task test → exit 0 (1767 passed, 105 steps, 0 failed; starter workspace 150 passed, 0 failed).
• deno task pack:dry-run → exit 0; deno task package-artifacts:check → exit 0 (5 packages).
• deno task fmt:check (1562 files), deno task lint (887 files), deno task typecheck, deno task lint:markdown (544 files, 0 issues) → all exit 0 — the exact commands the new CI steps/hooks run.
• actionlint 1.7.12 (darwin/arm64 binary, SHA-256 verified against the release checksums) on the edited workflow → exit 0.
• deno task arch:check, repo:hygiene, workflow:check, workflow:check-slimming, actions:check-pins, docs:truth, text-integrity:check, www:check-current-truth → all exit 0.
• sh -n .githooks/pre-commit .githooks/pre-push → exit 0.
• deno task autoflow:push --dry-run now selects only OE-specific gates (graph:check, package-surface:check, export-files:check, generate:ui-tokens:check, workflow:check-slimming, docs:check-role-neutral).
• This PR's own AutoFlow CI run is the authoritative in-CI evidence for the four new steps.

Scope

Touched: tools/autoflow/policy.ts (−4 gates), tools/autoflow/__tests__/policy.test.ts (RED→GREEN test), .github/workflows/autoflow-ci.yml (+4 fail-fast steps in the existing job), .githooks/pre-commit / .githooks/pre-push (direct OSS tool calls), deno.json (−1 duplicate task alias). No release-lane machinery (release.ts, loop-evidence.ts, release-lock.ts, version-anchors.ts) touched — B2.9 (#1231) already owns that. No frozen-semantics paths touched; no package source or public API changed.

Kept despite looking generic, with justification:

• test:coverage:check (coverage thresholds): no adopted OSS owner (no Codecov); deleting would silently drop protection. Candidate for a future ADR-0144 slice with a named replacement.
• text-integrity:check: the strict-UTF-8/mojibake portion is generic but has no adopted replacement; the forbidden-stale-truth-token portion is OE docs truth.
• build gate: product build / exact-artifact qualification; no external tool can own "our site builds with our adapter".
• check-fullstack-boundary.ts findSecretLeaks: scans the starter's BUILT browser bundles for server-secret material (OE secret/cache boundary, [0.43] test: qualify the Supabase × Cloudflare reference path across security, SSR and deployment boundaries #984) — gitleaks scans the repo, not built output.
• check-repo-hygiene.ts tracked-credential filename tripwire: kept per feat(governance): offload generic checks to mature OSS tooling (#1156 B2.6) #1294 (gitleaks does not flag a tracked-but-empty credential file).
• actions:check-pins / workflow:check-slimming: ruled OE-specific in feat(governance): offload generic checks to mature OSS tooling (#1156 B2.6) #1294; not re-litigated (no new evidence).

Risk

• Local hooks now invoke the OSS tools directly; contributors who never ran hooks:install are unaffected, and CI is authoritative either way (the four steps fail the autoflow-ci job).
• The four new CI steps run before Playwright installation, so generic failures now fail faster than before.
• The deleted task alias was referenced only by a historical dated audit doc (docs/audit/2026-08-23-...), which is left as an accurate historical record.