ci: adopt repo-sentinel-lite v0.8.1 consumer gate

[stacknil]

Summary

Adopt the reviewed production repo-sentinel-lite==0.8.1 release as the consumer integration boundary for issue #5.

• Pin the local pre-push hook to v0.8.1.
• Add a PR-only changed-file gate that blocks error findings and protected policy-file changes.
• Keep the full baseline audit explicitly non-blocking.
• Run synthetic PASS, FAIL, and redaction checks against the published package.
• Record the reviewed baseline state without copying raw token values.

Evidence Contract

• Consumer base SHA: 7db916e
• Consumer candidate SHA: 1b9a9db
• Scanner release: repo-sentinel-lite==0.8.1
• Scanner release commit: eed8f484ba3e50cf0e86b61591a52b744dadf56a
• Exact audit command: python -m repo_sentinel baseline audit --format json --baseline .reposentinel-baseline.json .
• Redacted audit artifact SHA-256: c2193422cdf638f173c33890eef455d88aed7b039e3f7dcc3bf43501902ab962
• Audit summary: active 272, relocated 7, changed 0, ambiguous 26, stale 0, unmatched 150
• Active repo.required_file_missing: 0
• Synthetic contract: PASS, FAIL, and redaction all passed locally
• Changed-file scan: no findings locally

Design Decision

Use the stable PyPI release as the consumer proof. Do not pin the provider main branch or a development commit. The changed-file job uses the base revision's baseline, blocks error findings, and treats .reposentinel.toml and .reposentinel-baseline.json as protected policy files. Baseline drift remains an independent, continue-on-error audit signal.

Main Risk

The reviewed baseline still contains known educational and documentation findings. The risk is controlled by keeping baseline drift visible and requiring human review for policy changes; no automatic baseline refresh is introduced.

Compatibility Impact

Scanner, baseline, and changed-file semantics remain those of the published v0.8.1 release. Existing configuration and baseline files are unchanged. The new workflow requires only contents: read and runs on pull requests.

Rollback Path

Remove .github/workflows/repo-sentinel-gate.yml to disable the remote jobs while retaining the local pre-push hook. The hook can be restored to the previous release pin if needed.

Validation

• python scripts/render_tags_doc.py --check
• python -m unittest discover -s tests -p 'test_*.py'
• python scripts/check_markdown.py
• python scripts/test_repo_sentinel_integration.py
• actionlint .github/workflows/repo-sentinel-gate.yml
• python -m pre_commit run --files .pre-commit-config.yaml docs/repo-sentinel-baseline-review.md .github/workflows/repo-sentinel-gate.yml scripts/test_repo_sentinel_integration.py