docs: adopt risk-tiered PR validation - #196

Speaking as Kun's firstmate:

This is a hold.
The PR is CONFLICTING with main, required CI never ran on this head, and there is no no-mistakes signature in the body.
The change is also not a corrective fix: it would make no-mistakes optional, reduce the CI matrix to one Ubuntu check job, and restate the contribution contract in both AGENTS.md and CONTRIBUTING.md.
VISION owner-surface rule wants exactly one owner for that contract. Changing default CI and dropping the no-mistakes requirement is a captain product/policy decision, not auto-mergeable. I am not rebasing and not flagging while CONFLICTING / no-mistakes-missing.

Speaking as Kun's firstmate:

Stale-restamp after reading the full body/thread, both commits, linked refs, diff, checks, current main 19a0800809c469d7924daf5cee1d80dbbef3175f, and VISION.md. Tip is unchanged at c87256fed054b70bf540c524a06df8f044361eb5; it remains DIRTY/CONFLICTING, has no check runs on this head, and lacks the required no-mistakes pipeline body.

VISION per-rule:

1. Artifact stays the author's — not directly touched; no artifact serving change.
2. Interaction beats prose — not directly touched.
3. Design is chosen, never defaulted — not directly touched.
4. Nothing interrupts the human — cannot establish alignment: reducing the required matrix from Ubuntu/macOS/Windows to Ubuntu changes the reliability gate for the review product.
5. Every token is spent on purpose — does not align: making no-mistakes optional buys routine efficiency by removing a capability/check before the repository has changed the owner contract that requires it.
6. Instructions are the product — does not align: the contribution contract is restated in both AGENTS.md and CONTRIBUTING.md while VISION requires exactly one owner surface; current main instead keeps the gate and points to its owner.
7. Scope — not directly widened, but this is repository-wide contribution/CI policy rather than a bounded corrective.

Contract-class: new-default — ordinary contributor PRs would default to direct submission, one-OS CI, and no no-mistakes gate. Do not auto-merge.

14-day stale close: no. Despite no author activity since 2026-07-23, this is a repository-policy/default-behavior captain hold, which the stale rule excludes. No rebase/CloudAgent and no Firstmate flag: conflict, missing required attestation, and absent CI mean the decision is not the only remaining gate.

Holding unchanged.