ops(governance): resolve declared-versus-live central review-policy drift

[seonghobae]

Read-only evidence

At 2026-08-26 the central repository main is 60a34005e59efe2b622897e3c7b06882bdf63aee. Its scripts/ci/audit_central_required_workflows.py declares that organization ruleset 18156473 must require exactly two approving reviews and require_last_push_approval=true.

A fresh API read of active ruleset 18156473 instead reports:

• required_approving_review_count: 1
• require_last_push_approval: false
• dismiss_stale_reviews_on_push: true
• required_review_thread_resolution: true

Searches for the ruleset id, audit script, approval count, last-push approval, and policy drift found adjacent issues (#771, #772, #1200 and closed #454), but none tracks this exact declared-versus-live mismatch. This issue does not authorize a ruleset mutation or a weaker gate.

Risk

An audit whose declared policy differs from the live authority cannot serve as immutable release-readiness evidence. A consumer may either reject every live payload for the wrong reason or silently rely on remembered policy instead of the policy GitHub actually enforces.

Acceptance

• The governance owner deliberately identifies the approved policy; automation must not choose between the two values.
• The declared policy, live ruleset, documentation, and deterministic audit fixtures agree through the normal reviewed governance path.
• Until they agree, the audit reports the drift explicitly and release-evidence consumers fail closed.
• A final read captures the exact central commit, complete live ruleset payload/digest, observation time, and audit result.
• Required workflows, stale-review dismissal, thread resolution, non-fast-forward protection, and other existing controls are not weakened; there is no bypass, direct protected-branch write, self-approval, or force update.

Related but non-duplicate ownership work: #771, #772, #1200.