chore: standardize staged delivery

[KristopherKubicki]

Summary

Make feature/fix → staging → main the normal delivery path. Contributors currently have inconsistent or missing branch instructions; normal work should enter the integration branch through a reviewed PR, then use a separate validated promotion.

Changes

• Add the repository lane and emergency-exception requirements to AGENTS.md, the contribution guide, README where present, and PR template.
• Add a PR routing check that allows feature/fork work into staging and permits promotion to main only from this repository's staging branch. It grants no label-based hotfix bypass, uses no checkout or secrets, and requests no token permissions.
• Preserve existing release/deployment triggers and stronger branch rules. Where an existing CI PR filter omitted the integration branch, extend only that PR filter.

Changed files: .github/CONTRIBUTING.md, AGENTS.md, README.md, .github/workflows/staged-flow.yml, .github/PULL_REQUEST_TEMPLATE.md.

Impacts

This is part of the organization-wide staged-flow cleanup. This PR targets staging; it does not merge or deploy any release. After review and integration, promote the workflow normally and require the resulting routing check in branch rules. A workflow file alone is not enforcement. Audit existing bot direct-push paths and reconcile incorrectly targeted PRs before enabling new restrictions; do not bulk retarget or merge other work. Existing application checks, human approvals, validated-artifact evidence, and release authorization remain required.

The previously missing staging branch was initialized from main at 3a596aba482185a48148e0d378f1c2b974044faf. The first release still requires verification of its lower-environment validation/deployment path; branch creation does not provision an environment.

Test Results

• New routing logic: 10 behavioral cases per repository (13 for WebGOAT), covering valid integration/promotion, direct feature rejection, fork impersonation, deleted fork, hotfix-name rejection, reconciliation, unknown base, and shell metacharacters. Organization test matrix: 843 passing cases across 84 configurations.
• Generated workflow YAML and embedded Bash syntax validated; new guides/templates/workflows formatted with Prettier 3.6.2.
• Existing application suites were not run locally for this policy/workflow change. Repository CI must pass before merge; this draft does not claim application regression coverage or active branch enforcement.