Resync Carried Instruction Set, Config, and README Against the Hub

[ptr727]

Phase 8 (fleet-wide Skills rollout) batch 2 of ptr727/ProjectTemplate's hub-docs-to-skills-conversion project.

Re-vendors 13 stale/absent verbatim AGENTS.md/GOVERNANCE.md sections against hub main, plus the whole-file config carries: .markdownlint-cli2.jsonc, repo-config/develop.json, repo-config/main.json, repo-config/README.md.

Re-vendors the github-release job in build-release-task.yml (declared verbatimJobs contract): action SHA pin bumps and the current one-sentence-per-line comment style, keeping this repo's own target-specific needs: list (console/docker only, no nuget/pypi) per WORKFLOW.md's per-target subsetting rule.

Adds host-tools.json (genuinely absent; an empty declaration since this repo needs no host tool beyond the fleet baseline). Retires the local repo-config/configure.sh copy per spec/divergences.json's retire disposition (hub-hosted, not carried), fixing its two remaining references in AUDIT.md and repo-config/README.md in the same pass.

Fixes AUDIT.md's ruleset-comparison snippet to stop diffing bypass_actors, the same gap caught on Financial-Modeling#111 in this batch, applied proactively here.

README: adds the required 3rd Party Tools section (19 dependencies and CI/dev tools, alphabetized, matched to the shared catalog where one exists); renames commit-link to commits-link and docker-link to docker-hub-link (shared destination names); renames history-link and license-link to bare history/license (in-repo paths carry no suffix); renames the Internal reference group to Distribution and reorders it before Repo (declared order), sorts External by reference name.

Post-push audit against this branch confirms convergence: only the two pre-existing, investigate-dispositioned hub-only findings (publish-release.yml, validate-task.yml) remain, out of scope for a per-repo resync.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.37%. Comparing base (83f5101) to head (0f9d3e0).

Additional details and impacted files

@@ Coverage Diff @@## develop #49 +/- ##
========================================
Coverage 43.37% 43.37% ========================================
Files 28 28 Lines 3896 3896 Branches 306 306 ========================================
Hits 1690 1690 Misses 2154 2154 Partials 52 52 

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR resyncs PhotoCleaner’s carried governance/configuration documents and repo configuration payloads against the fleet hub, updates README reference-link structure and adds a 3rd-party tools inventory, removes the locally carried configure.sh in favor of hub-hosted tooling, and adjusts a reusable release workflow job to match the latest hub-vendored style/pins.

Changes:

• Re-vendor carried instruction/docs content (AGENTS/GOVERNANCE/AUDIT) and repo-config ruleset payloads to reflect hub-managed vs unmanaged fields (notably excluding bypass_actors from comparison/payload).
• Update README.md reference definitions and add a “3rd Party Tools” section with link catalog entries.
• Remove local repo-config/configure.sh, add host-tools.json, and resync workflow job comments/action pins in build-release-task.yml.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
repo-config/README.md	Documents the managed ruleset payload subset and hub-hosted configure.sh usage.
repo-config/main.json	Removes bypass_actors from the carried ruleset payload.
repo-config/develop.json	Removes bypass_actors from the carried ruleset payload.
repo-config/configure.sh	Deletes the locally carried configuration script (now hub-hosted).
README.md	Refactors reference links and adds a 3rd-party tools inventory table and link definitions.
host-tools.json	Adds repo-specific host-tool overlay (empty, with explanatory note).
GOVERNANCE.md	Resyncs governance text and routes detailed rules to hub skills where applicable.
AUDIT.md	Updates audit guidance/snippets to exclude bypass_actors from ruleset diffs and points to hub tooling.
AGENTS.md	Adds the Fleet Bootstrap section and updates routing table entries to skill-packaged rules.
.markdownlint-cli2.jsonc	Minor comment capitalization adjustments to match style.
.github/workflows/build-release-task.yml	Re-vendors the github-release job pins/comments and release artifact handling notes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ptr727]

The actions/checkout pin finding on build-release-task.yml:142 auto-resolved (by the Copilot bot itself, confirmed via GraphQL resolvedBy) before I could reply on the thread. For the record: fixed in df5e50e, aligned to the v7.0.1 SHA already verified elsewhere in this repo (build-docker-task.yml, build-executable-task.yml, get-version-task.yml), rather than a new pin.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated no new comments.

Suppressed comments (1)

repo-config/README.md:5

• This line says configure.sh preserves and reports bypass_actors, but the next bullet clarifies the script is hub-hosted and the local copy is retired. Using the full hub path here avoids implying a local configure.sh exists in this repo.

- `main.json` plus one `develop` variant: the branch rulesets as the managed part of the writable API subset (`name`, `target`, `enforcement`, `conditions`, `rules`). The `develop` payload is `develop.json` (`release` repos) or `operational/develop.json` (`operational` repos). These are the canonical expected payloads that the self-audit (`AUDIT.md`) diffs the live rulesets against. `bypass_actors` is writable and deliberately unmanaged, so no payload declares one and nothing diffs it: who may bypass a ruleset is a human decision taken in the UI, which `configure.sh` preserves on `apply` and reports without asserting on `check`.

[ptr727]

Suppressed finding (repo-config/README.md:5, the bypass_actors bullet's configure.sh mention): fixed in 3439746. Same class as round 1, this one mention was missed in the sweep.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/build-release-task.yml:188

• This change pins softprops/action-gh-release to v3.0.1, which is a downgrade from the previous v3.0.2 pin. The PR description calls out "action SHA pin bumps", so please confirm this is intentional; otherwise it should remain at v3.0.2 (or be bumped to a newer version).

 uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1

[ptr727]

Suppressed finding (build-release-task.yml:188, the softprops/action-gh-release downgrade): fixed in d450770. Restored v3.0.2 (the SHA on develop before this PR, not re-typed). Also diffed every uses: line in the job against develop afterward and confirmed no other pin was silently changed by the re-vendor.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated no new comments.

Suppressed comments (2)

repo-config/README.md:5

• This bullet refers to repo-config/configure.sh as if it were present in this repo, but this PR deletes repo-config/configure.sh and the next bullet clarifies the script is hub-hosted. Qualify this reference as the hub's script to avoid implying readers should look for it locally.

- `main.json` plus one `develop` variant: the branch rulesets as the managed part of the writable API subset (`name`, `target`, `enforcement`, `conditions`, `rules`). The `develop` payload is `develop.json` (`release` repos) or `operational/develop.json` (`operational` repos). These are the canonical expected payloads that the self-audit (`AUDIT.md`) diffs the live rulesets against. `bypass_actors` is writable and deliberately unmanaged, so no payload declares one and nothing diffs it: who may bypass a ruleset is a human decision taken in the UI, which `repo-config/configure.sh` preserves on `apply` and reports without asserting on `check`.

README.md:928

• The project name is typically styled as “xUnit.net” (lowercase “net”). Using “xUnit.Net” is likely to read as a typo in this dependencies table.

| [xUnit.Net][xunit-link] | Test framework for .NET. |

[ptr727]

Two suppressed findings this round:

• repo-config/README.md:5 (qualify configure.sh as the hub's): fixed in 0f9d3e0, reads 'the hub's repo-config/configure.sh' now.
• README.md:928 (xUnit.Net casing): not changed. spec/third-party-tools.json's own catalog entry names it 'xUnit.Net', and spec/readme-structure.md's 3rd Party Tools rule says a shared tool is named identically everywhere it appears - a local casing fix would diverge from the catalog rather than fix a typo.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated no new comments.