ci: add stable governed admission

[dills122]

Summary

• expose the stable Governed admission job for current and future versioned governed targets without path filters
• route the guest-running upstream integration matrices away from every governed target family
• retain the governed Clippy routing for the upstream-named accepted line and new review/accepted names
• record the immutable upstream source, accepted r3 head, and fresh r4 review target

Governed identities

• upstream source: 728df8125077d0db44265f6e997c72b81b65c015
• accepted base and r4 initial target: 7432eda5a49220976b0167005aa43ee622f9d632
• proposed work head: a1f9ad617c0b89cd6df8048c85085d6de716a575

Verification

• git diff --check
• Ruby YAML parsing of .github/workflows/capsule-governed.yml, .github/workflows/code-quality.yml, .github/workflows/formatting.yml, and .github/workflows/integration_tests.yml

Boundary

This is fork governance and no-guest library evidence only. It does not move an accepted ref or default, execute a guest, sign or publish a release, or admit a Capsule backend or profile.

[dills122]

Maintainer self-review completed against base capsule/review-v1.19.4-r4 and head a1f9ad617c0b89cd6df8048c85085d6de716a575.

Confirmed the generic governed target filters, stable Governed admission job, governed formatting routing, and exclusion of guest-running integration jobs. The diff adds no guest, release, signing, publication, or product-admission action. The accepted r3 ref and repository default remain unchanged. Merge remains pending the explicit owner callback.