ci: harden PR-size exception governance against self-expansion

[qnbs]

Finding

PR #596 exposed a separate PR-size governance integrity class that is not owned by #510. The existing exception mechanism must not allow a governed pull request to become larger or less reviewable than the repository's absolute authority while it is in progress.

This issue owns the #596-class exception controls:

• an exception's governed semantic scope must not exceed the absolute tier;
• a governed PR must not self-expand or retroactively elevate its own exception;
• effective ceilings must be authorized from the base-side governance state;
• exception paths must remain inside an explicit allowlist;
• the embedded reason must be short and practical, with durable rationale referenced from an issue/doc/PR instead of an unbounded essay.

Relationship to #510

#510 owns the distinct write-scoped trust boundary where pr-size and workflow-policy execute enforcement/commenting code from PR-controlled checkout content. This issue does not duplicate that finding and does not choose its trusted-workflow architecture. The two controls are complementary and both remain required.

Required hardening

Add regression coverage for:

• files over the absolute ceiling → reject;
• commits over the absolute ceiling → reject;
• governed meaningful lines over the authorized exception ceiling → reject;
• self-expansion or retroactive exception elevation from the governed PR → reject;
• a changed path outside the exception allowlist → reject;
• a valid narrow, base-authorized exception → pass;
• an explicitly allowed supplemental generated/normative artifact → pass only under the narrow supplemental rule.

The implementation must preserve the ordinary absolute tier as the upper authority. It must not reopen or rewrite PR #596; use that PR as regression/postmortem evidence.

Scheduling gate

This is a prerequisite before:

1. any new PR-size exception is relied upon; and
2. R-15 implementation starts.

A small ordinary #553 PR that stays within the absolute tier may continue independently. If a future #553 slice needs an exception, this issue must be completed first.

[qnbs]

Implemented and validated via PR #657 (fix(ci): harden PR-size exception governance).

Evidence:

• PR fix(ci): harden PR-size exception governance #657 merged successfully.
• Final correction head: d708ce4fb9639c17a8b0c1f4bfe706dea7a41619.
• Resulting main: bae19f079537307605417ca91359982cd8439058.
• Exact-head CI/CD: SUCCESS.
• Exact-head CodeQL: SUCCESS.
• Resulting-main CI/CD: SUCCESS.
• Resulting-main CodeQL: SUCCESS.
• The implemented checker preserves the ordinary absolute tier as upper authority, reads exception authority from base-side governance state, rejects self-expansion/governance-control paths, bounds active exception ceilings to the absolute tier, restricts supplemental allowances to recognized non-executable artifacts, and retains historical fix(e2e): eliminate WelcomePortal startup/navigation nondeterminism (#532) #596 authorization only as historical evidence.
• The corrected governance was subsequently exercised successfully by PR feat(project): converge filesystem admission after #654 #658: PR Size Governance passed without an exception while the successor stayed inside the ordinary absolute ceiling.

The #625 scheduling prerequisite is therefore satisfied. Closing as completed.