fix(governance): keep transition authorization holds blocking

[bartytime4life]

Summary

Corrects the authorization-boundary regression merged through PR #1976.

• removes the workflow wrapper that converted validate_transition_authorization.py exit code 3 into success;
• restores direct propagation of EXPECTED_READINESS_HOLD as a nonzero, merge-blocking result for repository-control / authorize-ready-and-merge;
• adds focused workflow assertions that prohibit the exit-3-to-zero translation;
• adds an executable CLI test proving missing authorization returns exit code 3 with TRANSITION_AUTHORIZATION_MISSING.

Root cause

PR #1976 treated an expected readiness hold as successful workflow completion. That preserved diagnostic text but caused the trust-bearing authorization check to appear satisfied when no current exact-base/exact-head owner transition record existed.

Authority boundary

This change does not create authorization, mark a pull request ready, merge, approve, release, deploy, publish, or alter repository settings. It only restores fail-closed status propagation for the existing trusted-base, read-only guard.

Validation

• Python syntax compilation of the focused test file: PASS.
• Structural review of the trusted-base workflow: exit code 3 is no longer normalized to 0.
• Added executable missing-authorization CLI assertion: expected return code 3, outcome EXPECTED_READINESS_HOLD, reason TRANSITION_AUTHORIZATION_MISSING.
• Hosted exact-head workflows pending for this draft PR.

Rollback

Revert the two commits on this branch. No schema, validator implementation, platform setting, release state, or publication state is changed.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.