security(.github): enforce the deploy/ guards from a trusted ref or protected review, not from the pull request's own workflow

[devantler]

🤖 Generated by the Agentic Engineer

Second child of devantler-tech/platform#3376 — the enforcement-authority half, split from the CI check shipped by #182 (Fixes #181).

Evidence

Every deploy/ guard in this repository — scripts/validate-release-contract.sh and, with #182, scripts/validate-deploy-deletions.sh — runs from the pull request's own ci.yaml on the pull_request event. A pull request therefore controls the very workflow and script that judge it: it can edit or remove the step, or replace the validator, and still satisfy the only required status (CI - Required Checks). The active ruleset on main requires zero approving reviews and no code-owner review, so nothing outside the pull request's own diff stands between such an edit and a merge. CodeRabbit raised this on #182 as a Major (CWE-693) finding; it is real, and it is the same exposure the release-contract guard has carried since it was introduced.

Expected behaviour

The guards that protect deploy/ are enforced by something a pull request cannot edit out of its own path: an organisation-level required workflow that runs the checks from a trusted ref (the pattern validate-go-project.yaml already uses from devantler-tech/actions), or protected review that a change to the workflow and validator files cannot bypass. The parent issue's ruleset criteria (at least one approving review; code-owner review for deploy/) are the review-side design and carry a real trade-off — agent-authored pull requests are authored as devantler and cannot approve themselves — so the decision needs recording before it is applied.

Acceptance criteria

• A change that removes or neuters the deletion or release-contract step from ci.yaml, or replaces either validator, cannot reach main with only CI - Required Checks green — verified by reading the ruleset or required-workflow configuration back, not by setting it.
• The chosen mechanism (trusted-ref required workflow, protected review, or both) is recorded with its trade-off for agent-authored pull requests.
• Negative control recorded.

Rough size: M (design plus an org-level rollout).