fix(governance): pin UTC review dates and classify baseline evidence

[stacknil]

Summary

• evaluate pattern last_reviewed against datetime.now(timezone.utc).date()
• inject the review clock in validator contract tests
• document the redacted repo-sentinel baseline classification
• keep .reposentinel-baseline.json unchanged and the remote gate non-blocking

Design decision

Use an explicit UTC date provider for provenance validation. Tests inject a fixed clock for the Taipei/UTC boundary instead of depending on the runner's current date. The baseline review records classifications and tool provenance without copying raw token values.

Main risk

The v0.8 repo-sentinel audit input is from a development-line commit, not a released dependency. The report therefore records evidence and defers remote-gate enablement. One active repo.required_file_missing entry for LICENSE remains an unresolved repository-governance condition.

Compatibility impact

Existing pattern metadata remains valid. The only behavior change is that future-date validation is now consistently UTC-based across local and CI runs. No baseline entries are added, removed, or rewritten.

Rollback path

Revert the governance documentation commit, the contract-test commit, and the UTC behavior commit. This has no schema migration or persisted-data impact. A future remote job can be removed independently while retaining the local hook.

Verification

• python -m unittest discover -s tests -p 'test_*.py'
• python scripts/check_pattern_library.py
• python scripts/render_tags_doc.py --check
• python scripts/render_readme_snapshot.py --check
• python scripts/check_placeholders.py
• python scripts/check_markdown.py
• python -m pre_commit run --files ...
• npx --no-install markdownlint-cli2 docs/README.md docs/reviewer-brief.md docs/repo-sentinel-baseline-review.md patterns/README.md
• privacy scan over the committed diff