Consolidate ROSS automation workflows

[ranade-oss]

What changed

Consolidate the ROSS automation graph while preserving the existing fail-closed gates:

• reduce the GitHub workflow set from 18 to 11;
• combine agent dispatch/reconciliation into one hourly fallback with exact-head Baseline, review, mergeability, and unresolved-thread gates;
• combine Baseline merge and bounded repair handling under separate permission-scoped jobs;
• combine the two Mike dispatch wrappers and dispatch Baseline immediately for eligible low-risk synchronization PRs;
• exclude generated release-manifest-only pushes from the full Baseline;
• fold release-candidate and final-evidence outputs into the existing ROSS release train, retaining explicit public promotion and the production final-completion gate;
• remove obsolete one-time and permanently blocked workflow definitions;
• update governed manifests, documentation, website copy, and regression coverage.

The enabled external Repair ROSS Failures automation was updated transition-safely: it keeps current behavior until the new repository handlers exist on the default branch, then defers ordinary Baseline and agent-PR reconciliation work to the repository-owned handlers. The Mike bridge remains enabled temporarily for orphan/stalled queue recovery.

Why

The previous design started two five-minute pollers (the dominant source of Actions noise) and split ownership across duplicate wrappers and handlers. This keeps the safeguards and one-click operations while reducing nominal scheduled starts from roughly 579/day to about 27/day.

Validation

• npm test: passed all repository, backend, legal-source, security, and Baseline stages.
• Baseline suite: 159/159 passed.
• npm run check: passed toolchain, tests, high-severity dependency audit, backend build, and deterministic generation; the frontend build stopped only because this environment received HTTP 502 responses while fetching Google Fonts from fonts.gstatic.com.
• Independent website build: passed.
• Website route/accessibility tests: 13/13 passed.
• YAML parsing: all 11 workflow files passed.
• Release manifest and Ontario workflow-source checks: passed.
• No production or staging deployment was run.

This is intentionally a draft because it changes workflow permissions, triggers, and automation ownership.