Hard review: secure secrets, governance, scope, CI gates

[rokolslab]

Summary

• Hardened generated secrets handling and ignored local secret/runtime files.
• Added governance baseline docs, version policy, acceptance criteria, and AI Factory project rules.
• Clarified Ubuntu baseline: 24.04 primary, 26.04 validation target, 22.04 rejected as unsupported legacy.
• Clarified Supabase scope as PostgreSQL with selected Supabase-related components, not full Supabase.
• Removed unsafe public Compose override and replaced direct public exposure guidance with localhost/SSH tunnel/Nginx.
• Added static GitHub Actions quality workflow.

Commit series

• 89ab2bb fix: harden generated secrets handling
• 3492600 docs: add project governance baseline
• 55d781c chore: add ai factory project rules
• 85ac08c docs: clarify supabase-related scope
• 94d6d58 docs: align ubuntu baseline policy
• 5e6df0d fix: remove unsafe public compose override
• 201f867 chore: ignore ai factory plan artifacts
• 61298e9 ci: add static quality workflow

Safety / scope controls

• No secrets committed.
• .ai-factory.json, .opencode/, and .ai-factory/plans/ are ignored/local.
• No container startup was required for review.
• No install scripts were run during review.
• Public admin surfaces remain localhost by default.
• Direct public Compose override was removed.

Validation performed

• git diff --check
• Bash syntax checks
• ShellCheck locally
• docker compose --env-file env.example config
• docker compose --env-file env.example -f docker-compose.yml -f docker-compose.monitoring.yml config
• grep checks for removed public override references
• grep checks for Compose latest image tags
• tracked secret-file guard
• final branch-level review approved

Known follow-ups

• docker-compose.monitoring.yml still has obsolete version: warning; separate Compose cleanup PR.
• GitHub Actions workflow may fail if ShellCheck is not available on the runner; tool installation strategy should be separate if needed.
• Clean Ubuntu 24.04 VM smoke-test evidence still required before release-readiness claims.
• Changelog/release readiness remains future phase.
• Full Supabase remains deferred/not current support.

Review notes

This PR is intentionally a series of small, bounded changes from a hard repository review. It should be reviewed as a safety/governance baseline before continuing technical implementation work.

[rokolslab]

Superseded by clean replacement draft PR #2: #2