Govern G7 external adoption evidence

[terrizoaguimor]

Summary

• add a hash-bound G7 authority for interviews, real incidents, and independent pilots
• freeze the 0.1.x HTML/Vite/PliegoRS adapter support matrix against Tailwind 3.4.19 and 4.3.3
• make owned fixtures, synthetic incidents, missing consent/review, duplicates, and unsupported projects fail closed
• connect G7 to release readiness, CI, generated docs, sitemap, and the public evidence route

Evidence

• pnpm verify:fast (28/28 gates passed)
• npm run check:site (94 routes, 139 files, deterministic build and Chrome contract passed)
• pnpm check:external-adoption-authority (valid blocked state)
• pnpm check:external-adoption (expected exit 1: 0/10 interviews, 0/20 incidents, 0/3 pilots)

Boundary

This PR does not claim that G7 is complete and does not create a tag or release. Real reviewed external participation remains required.

[terrizoaguimor]

G7 operational update for ff38c4249b201ddec2022b52b81a5e4eef903c6c:

• Public recruitment is open in G7 external adoption cohort — applications open #7. An application remains a recruitment signal only; it is not consent or evidence.
• ff38c42 adds the privacy boundary, public interest form, sensitive-field/custody validation, pilot redaction, and a local SHA-256 preparer that never emits raw source bytes.
• The private contact is now operationally configured: Cloudflare Email Routing is ready/synced, public DNS exposes three MX records plus SPF, and exactly one literal rule forwards hello@pliegocss.dev to a verified corporate destination. Catch-all remains disabled.
• A synthetic message was sent from the destination account to the alias. Gmail exposed only the SENT copy, so same-account deduplication makes that test inconclusive; no end-to-end delivery claim is made until an external-origin message is observed.
• Hosted evidence for this exact commit: 68 checks passed, 0 failed, 0 pending. Four tag-only jobs (asset attestation and draft release, for push and pull_request) were skipped as designed.
• Local G7 authority, release authority, syntax, generated docs, and check:site passed (94 routes, 139 built files, deterministic SHA-256 5b688183ea15b298e2f85b6e8db98697f5082fd5fab433a834261193d4b0fff0, Chrome real). verify:fast on this Windows host reached Rust tests but three verification_cli cases were blocked by Windows Application Control (os error 4551); the hosted exact-commit matrix is green.

Promotion remains blocked: 0/10 interviews, 0/20 incidents, 0/3 pilots, 0/3 independent projects, and 0/3 independent organizations.