guardrails: authoritative CI and release gates after MVP #14

Parent epic: #13

Problem

The local client can guide safe behavior, but merge, release, and post-merge authority must not depend on local agent goodwill alone.

Deliverables

• CI or provider-enforced review freshness gates
• release and post-merge verification policy
• documented split between local preflight checks and authoritative server-side gates

Acceptance

• the repo documents which gates are local-only versus authoritative
• release-sensitive operations are enforced outside the local client
• this work stays separate from the MVP floor so issue guardrails: safe agents and workflow commands #5 does not absorb CI policy scope