chore(github): sync the organization forms and repin commit-lint

[ss-o]

Summary

• Replace the vendored .github/ISSUE_TEMPLATE/01_bug_report.yml and 05_membership.yml with byte-for-byte copies of the organization forms at z-shell/.github 362528e (blobs 9847bd7 and 103bdfb). The bug form is now project-neutral: affected version, a multi-line environment (Zsh version, OS, loading method), a minimal reproduction from zsh -f or a clean HOME, actual and expected behavior, and optional additional information. The membership form's two policy links, which returned 404, now resolve.
• The wiki form 01_request_documentation.yml is an approved exception and is unchanged, as are config.yml and the other vendored forms.
• Repin .github/workflows/commit-lint.yml from z-shell/.github 64a427d to 6fac3d4 (ci: support shared Zi quality workflow contracts .github#765), which drops the called workflow's concurrency group as fix(ci): duplicate edit and push runs leave cancelled required checks that block merges zi#597 requires, and update the caller's comment to match. On 64a427d the Commit Lint run for this pull request ended in a startup failure with no jobs, so the four required Policy checks never reported; on 6fac3d4 they pass.

Refs z-shell/.github#769

Verification

• Commit Lint: startup failure on d9cc3b9 (pin 64a427d), success on ed430f2 (pin 6fac3d4).
• git rev-parse HEAD:.github/ISSUE_TEMPLATE/01_bug_report.yml and 05_membership.yml print 9847bd7357eec0ce15cc65937f619f17f0ebb55c and 103bdfb1133aa97d380b14bc3929faf99a931b16, the organization blobs, after the commit hooks ran.
• Both new membership links return 200: .github/GOVERNANCE.md and .github/CODE_OF_CONDUCT.md in z-shell/.github.

Agent handoff

No handoff needed.

[cloudflare-workers-and-pages]

Deploying zsh with    Cloudflare Pages

Latest commit:	ed430f2
Status:	✅  Deploy successful!
Preview URL:	https://6f4b8ee5.zsh.pages.dev
Branch Preview URL:	https://feature-769.zsh.pages.dev

View logs

[ss-o]

Fallback review under ADR-0026: Copilot request not registered on ed430f2

Findings

No actionable findings.

Scope: the complete diff of ed430f2 against main at e07ad1e: the vendored 01_bug_report.yml and 05_membership.yml, and the commit-lint.yml caller.

Important

Sole-maintainer exception under ADR-0035. The maintainer declared that no second human is available and elected the exception for this pull request at ed430f2. A Copilot review was requested at 2026-10-09T12:20:08Z and no review_requested event for Copilot followed; the cause is unconfirmed. A separate read-only review of the same head ran in a different reviewing session, as ADR-0035 decision 3 requires. Additional automated scrutiny is not a second human.

Note

This review is by the pull request's author. It does not approve deployment or release.

Separate read-only review

Head confirmed as ed430f2 with merge-base e07ad1e (the tip of main). No actionable findings. Vendored forms: all eight organization forms in .github/ISSUE_TEMPLATE are byte-identical to z-shell/.github at 362528e, and the one approved exception, 01_request_documentation.yml, matches its pinned blob. Workflow pin: 6fac3d4 is a full SHA on z-shell/.github main and still the latest commit touching commit-lint.yml; it differs from 64a427d only by removing the concurrency group; the caller passes no inputs and keeps contents: read. Supply chain: 64a427d is on no z-shell/.github branch, so the repin also moves to a commit on main. Limits: the startup failure on 64a427d was not reproduced, and no site build was run.

Validation

• Passed: all checks on ed430f2, including the four required Policy checks, CodeQL, Trunk Code Quality, Org Routing, Validate Corpus and the Cloudflare Pages preview. On the previous head d9cc3b9 (pin 64a427d) Commit Lint ended in a startup failure with no jobs.
• Blobs: 01_bug_report.yml is 9847bd7 and 05_membership.yml is 103bdfb, the organization blobs.

Checklist verdicts and supporting evidence

• Source contracts: met. The wiki carries the organization forms (vendor_org_forms: true in z-shell/.github template-exceptions.yml), and the copies match the blobs the community-health audit compares against.
• Failure paths: improved. Without the repin, the required Policy checks never report on any wiki pull request.
• Supply chain: met. Full-SHA pin with the interim # main comment, on main; permissions unchanged.
• Deployment: no site change expected. pages-deployment.yml builds and deploys on every push to main; this diff touches only .github/, which the site build does not read. The main build of the merge commit is checked after merge.

Limits and recovery

• Why 64a427d fails to resolve is inferred (it is on no branch), not confirmed; tracked in z-shell/.github#774.
• Recovery: revert the squash commit; the previous forms and pin are restorable from main at e07ad1e.