[Task]: GitHub's own rendered pages are outside the live-surface hygiene check

[yuedai-pbc]

Task ID or area

area: repository hygiene / public contact surfaces under .github/

Technical direction

Core control-plane hardening (build and public-boundary hygiene)

Intent

I want to implement this task.

Goal and acceptance gap

examples/repository-hygiene-smoke.py decides what counts as a live surface by path prefix:

LIVE_SURFACE_PREFIXES = ("loopx/", "scripts/", ".github/workflows/", "packages/")

Under .github/ it collects only workflows/. That excludes the files GitHub itself renders to the person about to contact this project, so the check that was added for #4776 never looks at them:

• SECURITY.md — the vulnerability reporting entry,
• ISSUE_TEMPLATE/config.yml — the contact links shown on the new-issue page,
• ISSUE_TEMPLATE/bug_report.yml — the same address inside the report form,
• SUPPORT.md — the support routing list,
• PULL_REQUEST_TEMPLATE.md — the guidance line every contributor copies,
• GOVERNANCE.md — the ruleset link the file itself describes as live.

Twenty address uses across those six files still carry the pre-transfer repository address — while .github/workflows/, the one path the gate does police, is already clean. They resolve today only because the transfer left a redirect, which means the failure is silent in both directions: a reader is handed an address the project does not own as its canonical name, and the check cannot see it.

Proposed scope

In scope:

• widen the live-surface prefix from .github/workflows/ to .github/, so the gate covers what GitHub renders, without changing the rule itself (a file is live by where it is, never by what else its text contains),
• repoint the live address uses in those five files at the canonical repository,
• record the two GOVERNANCE.md uses that name a historical event (where the project started, and which issue settled a roster change) as reviewed path+use exceptions, while the ruleset link in the same file stays under review as live,
• remove LIVE_ADDRESS_USES: it has no reference anywhere in the repository, and its comment describes a live-versus-citation split the implementation never applies. It is the easiest thing in that file to "fix" by editing a constant that does nothing.

Out of scope, and deliberately not folded in:

• apps/presentation/site/public/blog/** and benchmarks/deepswe-sol/ — published prose that mixes live pointers with dated citations, so each one is a judgment about whether the sentence is history. That belongs in front of a maintainer rather than being decided inside a prefix change.
• the tracked build output loopx/web/chat/assets/index-<hash>.js, which [Queue] 19 个 open PR 与 main 冲突：其中 7 个只卡在两组 append-only RFC ledger，3 个卡在已提交的前端 bundle #4677 already names as the structural cost.

Intended base branch

main

Relevant files or commands

• examples/repository-hygiene-smoke.py
• .github/SECURITY.md, .github/SUPPORT.md, .github/GOVERNANCE.md, .github/PULL_REQUEST_TEMPLATE.md, .github/ISSUE_TEMPLATE/config.yml, .github/ISSUE_TEMPLATE/bug_report.yml
• python3 examples/repository-hygiene-smoke.py, python3 examples/docs-governance-smoke.py, loopx check --scan-path … over the touched paths

Validation plan

• repository-hygiene-smoke passes with the widened prefix and the repointed live uses.
• docs-governance-smoke still passes, so the governance records stay self-consistent.
• mutation evidence: reverting the prefix to .github/workflows/ must fail an explicit "this rendered file is a live surface" assertion, and removing the GOVERNANCE.md exception must report its historical citations as offenders — together those two show the change widens coverage without loosening the rule.
• ruff check, py_compile and git diff --check clean on every touched path.

Public/private boundary

• This issue does not include private benchmark traces, verifier output, credentials, internal document links, raw agent sessions, or local runtime state.
• I will not run or duplicate maintainer-owned benchmark cases unless a maintainer explicitly splits out a public task.

Refs #4776, #4677