ci: vendor governance-enforce — this repo was never in the A_BLOCK ruleset

.github/workflows/governance-enforce.yml

@@ -0,0 +1,59 @@
+name: governance-enforce
+
+# A_BLOCK gate: no-secrets-in-git / secrets-from-doppler / no-hardcoded-paths, enforced on the
+# PR diff via the @wave-av/governance package (the org fan-out channel). Diff-scoped: blocks NEW
+# violations without failing on legacy debt. Isolated install bypasses any min-release-age policy.
+# The org ruleset `governance-a-block-enforce` requires this job's `enforce` check.
+#
+# VENDORED 2026-08-05 (claude-workstation#1624, E4 T4.9a). This repo was never in that ruleset's
+# include list, because the list is 112 hand-maintained names and every one of them matches
+# `wave-*`. A naming convention had silently become a security boundary: the repos that publish
+# our npm packages — cli, sdk, adk, mcp-server, workflow-sdk — were the ones running with no
+# A_BLOCK secrets scan at all. Copied verbatim from wave-moq-edge, and proven on a PUBLIC repo
+# before fan-out: wave-av/cli#20, run 31011943790, conclusion success.
+#
+# DO NOT add this repo to `governance-a-block-enforce` until this check is observed green here.
+# A required status check that never reports is a permanent deadlock, not a stricter gate.
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+
+permissions:
+  contents: read
+  packages: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  enforce:
+    runs-on: ubuntu-latest
+    env:
+      NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+      - name: fetch governance enforcer (isolated install)
+        run: |
+          mkdir -p "$RUNNER_TEMP/gov" && cd "$RUNNER_TEMP/gov"
+          printf '@wave-av:registry=https://npm.pkg.github.com\n//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' > .npmrc
+          npm install @wave-av/governance@^0.4.4 --no-save --no-audit --no-fund
+      - name: A_BLOCK enforce (secrets + hardcoded paths on the diff)
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PUSH_BEFORE_SHA: ${{ github.event.before }}
+        run: |
+          BASE="${PR_BASE_SHA:-$PUSH_BEFORE_SHA}"
+          if [ -z "$BASE" ] || [ "$BASE" = "0000000000000000000000000000000000000000" ]; then
+            BASE=$(git rev-parse HEAD~1 2>/dev/null || git rev-parse HEAD)
+          fi
+          echo "diffing against $BASE"
+          node "$RUNNER_TEMP/gov/node_modules/@wave-av/governance/bin/enforce.mjs" --changed "$BASE"