Integrate remaining low-risk upstream maintenance

[ranade-oss]

What changed

• adapts upstream lockfile merge-corruption guards across all ROSS workspaces;
• adds ROSS-specific contributor testing guidance and a PR verification template;
• ignores the generated local Supabase scaffold;
• removes the verified-unused Supabase request helper without changing active authentication middleware;
• records the completed low-risk Adopt / Adapt / Skip inventory.

Risk

Low. No dependencies, active authorization paths, schemas, migrations, deployment, provider configuration, or production runtime behaviour are changed.

Verification

Baseline must pass on exact head e018953444511f88e3767f29ca6ee79337296a42.

The prior dispatched run exposed one deterministic error: governance attempted to parse a nonexistent root package-lock.json. The current head validates only the root package.json plus the three actual workspace lockfiles.