fix(governance): refresh zi exception pins, skip opensource.org links

[ss-o]

Summary

• Zi moved its integration to protected main in chore: cut over Zi integration to protected main zi#631. That changed .github/PULL_REQUEST_TEMPLATE.md and docs/CONTRIBUTING.md and deleted .github/PULL_REQUEST_TEMPLATE/promotion.md, so the daily Community Health Audit reported drift for z-shell/zi. This refreshes both blob IDs to the files on zi main, restates their reasons for the ADR-0039 branch model, and removes the promotion template exception.
• opensource.org answers 403 to automated clients, so Lychee fails on the Popular Licenses link in the charter. .github/lychee.toml now excludes that domain; the charter text is unchanged.

Verification

• ruby automation/governance/repo-settings-audit.rb --all-repos --community-health --workflow-pins --skip-settings --fail-on-drift: exit 0, no drift in any repository.
• lychee --config .github/lychee.toml './**/*.md*' './**/*.html': 1383 links, 0 errors.
• ruby automation/governance/test-repo-settings-audit.rb, knowledge-delivery.py --check and knowledge-coverage.py pass.

No handoff needed.

[ss-o]

Fallback review under ADR-0026: Copilot request not registered on 430e3e7

Findings

No actionable findings.

Scope: the complete diff of 430e3e7 against main at 6f37298.

Note

This is a self-review by the pull request's author, not an independent review or approval to merge.

Validation

• Passed: Community Health Audit (no drift in any repository, z-shell/zi included), Repo Settings Audit Tests, Validate Agent Instructions, Org Routing, CodeQL and the four Policy checks on 430e3e7.
• Failed, expected: links-check reports the same two opensource.org 403 errors as main. Lychee runs on pull_request_target, so this check reads .github/lychee.toml from main, not from this pull request (its run excluded 7 links, the count for the main config). Lychee v0.18.1, the version the workflow uses, run locally with this branch's config on the same 1432 links: 0 errors, 9 excluded (the 7 plus the two opensource.org links). The check on main after merge is the hosted proof.
• Copilot: requested at 2026-10-09T19:09:20Z; no review_requested event for Copilot followed (only the CODEOWNERS team request at 19:09:08Z).

Checklist verdicts and supporting evidence

• Blob IDs: match zi main. .github/PULL_REQUEST_TEMPLATE.md is 3c4dc44 and docs/CONTRIBUTING.md is 5b318bf at the contents API on z-shell/zi main after z-shell/zi#631; .github/PULL_REQUEST_TEMPLATE/promotion.md returns 404 there.
• Reasons: accurate. The zi template states the protected main model and keeps the Migration plan section; the zi guide covers the branch model, Zsh verification and signed milestone tags, which the organization guide does not.
• Exclusion: narrow. Only ^https://opensource\.org/ is excluded; the charter text is unchanged and the domain answers 403 to curl with and without a browser user agent.

Limits

• The opensource.org exclusion stops checking that domain at all; a link that really breaks there will not be reported.