fix(governance): reconcile transferred repository custody

[4444J99]

Summary

• re-key the completed private-repository custody overrides to their live 4444J99/* coordinates without changing classifications or reasons
• register stable identities and historical organvm/* aliases for the four completed transfers
• pre-register repository ID 1247808935 as 4444J99/personal while retaining both organvm/personal and 4444J99/personal vault-private overrides; this PR does not transfer personal
• repair the sovereign value-tier and predicate coordinates, plus the incidental stable-ID-confirmed portfolio predicate drift
• make the public portal fail closed by joining explicit-public estate policy to the exhaustive redacted GitHub census; local paths, branches, remote hashes, and all private rows are no longer rendered
• record that dynamic server-side CodeQL/default-setup schedules must be inventoried even when no workflow file exists

Stable identity entries

Repository ID	Canonical coordinate	Historical alias
1258551472	4444J99/euro-trip-2026	organvm/euro-trip-2026
1248716739	4444J99/opencode-plans	organvm/opencode-plans
1248665097	4444J99/prompt-registry-archive	organvm/prompt-registry-archive
1204250615	4444J99/sovereign--ground--4444j99	organvm/sovereign--ground--4444j99
1247808935	4444J99/personal (pre-registered only)	organvm/personal

Portal safety evidence

The tracked census is exhaustive and ready: 320 repositories, 84 private rows redacted, 0 failures, 0 unaccounted. Regeneration now emits:

• 42 live canonical coordinates admitted by an explicit public policy row
• 0 private rows
• 0 local workspace paths
• 0 branch names
• 0 remote hashes
• no occurrence of sovereign--ground--4444j99

One desired-public coordinate, organvm/4444J99.github.io, is absent from the live census and is omitted fail-closed rather than guessed.

Validation

• duplicate-key-safe YAML parse: pass
• JSON parse and unique repository-ID assertions: pass
• Python compile and exercised portal join/render functions: pass
• generated public-portal/index.html and README.md exactly reproduce from the modified generator and checked-in census: pass
• exact branch diff: 7 files, 1 commit, 0 unrelated paths
• branch is one fast-forward commit ahead of main

Draft intentionally: the portal sanitization is a broad security correction and should be reviewed before merge.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}