Promote Governor idempotency, Knowledge context, and loop hardening

[Svaag]

Summary

• pin the live Engineering Loop on loop to AS215932/engineering-loop@2575131
• carries Reliability Governor decision idempotency from Fix Governor idempotency and #350 human-gating engineering-loop#35
• carries loop self-observability hardening from Harden loop self-observability engineering-loop#36
• carries Add resolv01/resolv02 recursive DNS64 resolver VMs and separate authoritative DNS from resolving #350-shaped production DNS64/resolver infrastructure human-gating regression
• pin Knowledge MCP, Knowledge Loop, and NOC Knowledge to AS215932/knowledge@63d8041
• carries A0 GitHub issue context and explicit issue-ref context-pack protection from Add A0 GitHub issue context for knowledge gaps knowledge#32

Checks

• uv run --with jinja2 pytest tests/iac/test_app_version_pins.py tests/iac/test_mock_render.py tests/iac/test_vault_and_runner_contracts.py
• scripts/ci/iac-static.sh

Operational note

The Reliability Governor timer should remain paused until this PR is merged and the production apply has installed these pins.

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 35 - Partially compliant Compliant requirements: (none – this PR does not add or modify any code implementing service_restart_history) Non-compliant requirements: The service_restart_history function, its data structures, platform-specific parsing, and cadence computation are not present in this PR diff. Requires further human verification: The pinned engineering-loop version (535cf5c) is claimed to include this feature; verify by inspecting the upstream commit. 350 - Partially compliant Compliant requirements: (none – this PR does not add or modify any resolver infrastructure) Non-compliant requirements: None of the resolv01/resolv02 inventory, Ansible roles, firewall rules, monitoring, documentation, or test changes are visible in this PR diff. Requires further human verification: The PR description mentions "production DNS64/resolver infrastructure human-gating regression" but no code changes for the resolver VMs are present. The pinned commit may include related work; verify upstream.

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🏅 Score: 95

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

[github-actions]

PR Code Suggestions ✨

No code suggestions found for the PR.

[Svaag]

Deployment note: all PR checks passed. Immediate merge and auto-merge are both blocked by repository policy (required review; auto-merge disabled). The live hyrule-reliability-governor.timer remains paused until this pin lands and is deployed.

[Svaag]

Updated this promotion PR after AS215932/knowledge#32 merged.

Current scope:

• Engineering Loop -> 535cf5c for Governor idempotency and Add resolv01/resolv02 recursive DNS64 resolver VMs and separate authoritative DNS from resolving #350 production-network human-gating.
• Knowledge MCP, Knowledge Loop, and NOC Knowledge -> 63d8041 for A0 GitHub issue context and explicit issue-ref context-pack protection.

Local validation and refreshed GitHub checks are green. Merge is still blocked by required review/base branch policy, so the live Reliability Governor timer should remain paused until this PR is reviewed, merged, and the production apply installs these pins.

[Svaag]

Status update after self-observability pin refresh:

• Engineering Loop pin now includes Harden loop self-observability engineering-loop#36 at 2575131 (cost reporting, false-pass gate handling, planner acceptance criteria, per-issue budget sizing).
• Knowledge pins remain at AS215932/knowledge@63d8041.
• Local validation passed: uv run --with jinja2 pytest tests/iac/test_app_version_pins.py tests/iac/test_mock_render.py tests/iac/test_vault_and_runner_contracts.py and scripts/ci/iac-static.sh.
• GitHub checks are green on 437a46b.
• Merge is still blocked by required review (reviewDecision=REVIEW_REQUIRED).
• The live hyrule-reliability-governor.timer remains inactive and disabled until this PR is reviewed, merged, and applied on the loop host.