Roll out software supply-chain assurance across eligible repositories #16

Outcome

Adopt the Hygiene supply-chain assurance profile and reusable Relay workflows across the Ego Hygiene repository fleet through staged, reversible convergence.

Dependencies

• Define the organization software supply-chain assurance profile hygiene#26
• Publish reusable supply-chain evidence, signing, and provenance workflows relay#44
• Model and visualize organization supply-chain assurance evidence observatory#10

Scope

• Inventory repositories, release types, packages, containers, current SBOM/provenance/signing controls, owners, and applicability.
• Produce dry-run changes and explicit blocked/not-applicable decisions.
• Pilot a small library, a static site, and a container-publishing repository.
• Adopt pinned reusable workflows rather than copied YAML.
• Verify public/private disclosure, rollback, exception expiry, and evidence freshness.

Acceptance criteria

• Every repository has an explicit applicability and ownership decision.
• Canary adoption is reviewed before fleet rollout.
• Existing secure controls are preserved or migrated deliberately.
• Missing or failed evidence cannot render as verified.
• Consumer PRs are small, reproducible, and rollback-safe.
• Observatory and Repository Intelligence reflect adopted profile versions and freshness.
• No repository needs to maintain a fork of the Relay implementation.