Wave 4: harden risk proof and gate contracts

[RyshMan]

Problem

Wave 4 hardening needed stronger deterministic risk/proof coverage for agent attack paths plus explicit CI governance for wave sequencing and scan contract safety.

Changes

• harden risk classification and attack-path scoring for agent framework context, edge rationales, and deployment/delegation amplification
• enrich proof mapping, evidence normalization, and compliance coverage so agent context and mapped rule IDs survive into emitted records
• add wave gate contracts, PR templates, required checks, and CI validation for branch protection and scan JSON/exit-code guardrails
• update docs and product references for the new wave-gate and attack-path hardening behavior

Validation

• go run ./cmd/wrkr scan --path ./scenarios/wrkr/scan-mixed-org/repos --json --quiet > /tmp/wrkr-ship-readiness.json
• make prepush-full

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ee8461e2ed

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[RyshMan]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.