chore: cut over Zi integration to protected main

[ss-o]

Summary

Ordinary Zi contributions move to protected main after #630 delivered replacement qualification. Remove the main source guard, historical promotion issue closure and promotion template; remove next-only triggers and switch repository contribution guidance to main. No loader, installer or self-update channel changes.

Refs #628 and z-shell/.github#771. Implements accepted ADR-0039. This fork PR supplies the required real fork-qualification evidence.

Verification

• Native actionlint passed all seven changed workflows; CI-registration passed for all 41 retained test files, and stable-qualification regressions passed, including every failed, cancelled and skipped constituent.
• Targeted Trunk passed all eleven retained changed files, including migration evidence and branch guidance. Signed commit and clean worktree verified.
• Promotion chore: promote qualified migration staging to main #630 retained the reviewed next tree, historical main ancestry and tags, passed full hosted stable qualification, and delivered verified main SHA 6840325cf4974c82324c08fdcbee004b0fc9274b.
• Its first main push exposed caller/reusable-workflow concurrency collision. Hotfix ci: isolate stable qualification caller concurrency #632 repaired that through normal protected merge 07743c2399ccce9fb1faeec1c598e149986edb9d; full main-push qualification 37962770980 and the separate Zsh, ZD Integration, Trunk and CodeQL push workflows all pass on that exact SHA. This topic includes that repair through a signed merge of current main; no history was rewritten.
• Historical closure run 37948678641 and a read-only replay report no unqualified closing clause outstanding in the promoted PRs. chore(ci): qualify ordinary main PRs and separate milestone publication #628 stays open for coordinated delivery.
• An isolated old-main clone self-updated through the public main remote to the delivered SHA, preserved checkout and loaded revision after a failed fetch, and succeeded on retry on Linux Zsh 5.9.2.
• The existing-consumer probe also updated from 6840325c to 07743c23, verified the loaded revision and repeated failed-fetch preservation and recovery. Final cutover consumer verification remains a post-merge gate.

Protection and release contract

The existing trusted-base source guard rejects fork heads while the old source-policy rule remains required. Its failure is expected during qualification of this cutover PR. Before merging, require successful full fork stable qualification and every emitted policy, contract, Trunk, CodeQL, Zsh and routing context; replace the source-guard requirement with that full set, signatures and resolved threads while retaining strict checks and no bypass actors. Verify the live settings and reviewed current head before the authorized merge. The retired guard must cease being a required context, rather than be bypassed or falsified.

The live release-tag rules already protect updates and deletion and retain their existing administrator role. Add tag creation restriction under that same role so ordinary write access does not authorize a signed milestone. No tag, release, signer key or new bypass actor is created by this PR. Ordinary merges never publish a milestone.

Keep remote next and its ruleset until downstream synchronization, final consumer checks, retained-history and open-PR verification are complete and branch retirement is separately authorized. Existing unmerged topic work and task owners are preserved.

Agent handoff

• Status: In progress; cutover candidate.
• Blockers: Current-head fork qualification, replacement-settings read-back and review of record. Final main push qualification and fresh consumer verification follow merge.
• Next steps: Complete those gates, then finalize canonical organization policy, wiki and private tracking/generation under the coordinated migration. Retire remote next only after its separate cleanup authorization.

Instruction impact review

1. Classification: Zi-local branch guidance and workflow enforcement implementing accepted shared ADR-0039; no runtime adapter changes.
2. Consumers: Humans and all agents working in Zi, including fork contribution contexts. The coordinated organization/wiki/tracking updates remain separately owned dependencies.
3. Canonical owner: Zi owns its local branch guidance and workflow implementation; z-shell/.github owns the organization decision and generated public guidance.
4. Consistency: The organization baseline already makes its historical exception conditional on verified cutover. This PR preserves that staged dependency and does not maintain a second organization policy source.
5. Routes: No routable surface is added, renamed or removed; the existing generated organization-routing block and skill pins remain byte-identical. Both manifests retain their current selectors.
6. Mandatory delivery: AGENTS.md remains direct repository guidance for supported runtimes. Enforcement rests on hosted required checks and live rules, with optional skills/hooks supplementing it. Private runtime discovery remains unverified here.
7. Generated output and limits: No generated instruction block changed; targeted lint and CI-registration checks pass. Hosted organization-routing verification remains a required current-head check; private composite regeneration belongs to the downstream tracking task.

[ss-o]

Fallback review under ADR-0026: maintainer elected, no Copilot request on fbd1da4

Findings

No actionable findings in the complete 18-file diff against main 07743c2399ccce9fb1faeec1c598e149986edb9d, which is also the merge base. Reviewed signed candidate fbd1da4e, including the signed merge carrying #632 and the latest migration evidence.

Note

This is a maintainer-elected self-review, not an independent review or approval to merge.

Validation

• Passed: Full fork qualification completed all 21 jobs on the reviewed SHA: six Linux/macOS Zsh 5.8.1/5.9/5.9.2 legs, eight ZD jobs including compatibility, full Trunk, CodeQL, clean installation/startup, real-object lifecycle and both aggregate gates. All eleven proposed required contexts succeeded, including policy, contract and organization routing checks.
• Passed locally: zsh -f tests/ci-registration.zsh confirms all 41 retained focused tests are registered; zsh -f tests/stable-qualification.zsh verifies the actual aggregate rejects failed, cancelled and skipped constituents and prevents the caller/reusable concurrency collision. Native actionlint and targeted Trunk passed the retained changed workflows and guidance; git diff --check passes. The candidate signature is verified locally and by GitHub.
• Expected failure: The trusted-base Guard main branch source rejects this fork topic under the old source contract. It is not waived or falsified. The authorized cutover must replace that required context with the complete proven check set before a normal protected merge.

Checklist verdicts and evidence

• Scope and compatibility: PASS. Changes remove the old guard, promotion-only issue closure and template, retire next triggers and update contribution guidance. No loader, installer, updater, public API or dependency changes occur. All deleted script/test consumers are removed; no surviving workflow or script references remain. Historical records remain preserved.
• Qualification and workflow safety: PASS. Main PR and push qualification remain unconditional on relevant paths and test exact candidate content, including real fork execution. Pinned reusable workflows, permissions and the repaired caller concurrency remain intact. The retained aggregate fails closed for every constituent.
• Historical delivery and issue closure: PASS. Promotion #630 preserves prior main and reviewed next ancestry. Main-push qualification passed on repaired main 07743c23. Historical reconciliation and read-only replay found no outstanding unqualified closing clause. Native default-branch closure replaces the retired machinery; #628 remains open for coordinated work.
• Protection and milestone authority: READY, application pending. Prepared main rules retain strict checks, deletion/force-push protection, resolved threads and no bypass actors; add signed commits and the nine existing next contexts to Promotion gate and Release plan, for eleven required checks. Merge/squash methods preserve existing main history without imposing linear history. Prepared release-tag rules add creation restriction while retaining existing update/deletion protection and the existing administrator role only. No tag, release, signing key or new actor is created.
• Instructions and ownership: PASS. Zi owns the changed local guidance; its generated routing block, selectors and approved skill pins remain unchanged. Accepted ADR-0039 explicitly gates supersession on verified cutover. Organization policy, wiki and workspace tracking updates remain coordinated dependencies with their own preserved work.
• Feedback and preservation: PASS. The PR conversation, reviews and fully paginated review threads contain no findings or unresolved threads. Main/next history and tags remain retained; topic owners and unmerged work are preserved.

Limits and follow-up

Before merging, read back applied main and tag rules, recheck this exact head and its checks, then use a normal protected merge with a matching-head condition. The failed old guard remains a blocker until its requirement is replaced through the approved settings change. Browser rendering was unavailable; Markdown source and stored review body are verified separately.

After merge, require full exact-main push qualification and fresh-install/existing-consumer update, failed-fetch preservation and retry on the delivered SHA. Existing pre-cutover consumer evidence is Linux Zsh 5.9.2; hosted macOS results are separate evidence. Canonical organization/wiki/tracking synchronization and separately authorized next retirement remain under #628 and z-shell/.github#771/#772. No milestone publication or cleanup is authorized by this review.