Align governed document lock hashes with current protected documents

[Copilot]

This PR addresses a stale protected-document lock registration: the repository’s governance manifest was still recording older SHA-256 values for six active governance documents even though the current source bytes already matched the intended protected versions. The result was a manifest mismatch rather than a content drift issue.

• Overview

  • Repair the lock manifest without altering the protected document bytes.
  • Keep the repository’s governed-document validation consistent with the exact committed files.

• Changes

  • Updated the six stale lock entries in config/governance/governed_document_lock_manifest.json:
    • GEMINI.md
    • docs/governance/instruction_core_custom_instructions.md
    • docs/governance/policy_organization_constitution_handbook.md
    • docs/governance/policy_manifest_governance.md
    • docs/governance/policy_organization_foundation_operating_model.md
    • docs/governance/policy_organization_incident_change_appendices.md
  • Kept the patch limited to expected_hash and sha256 values so the manifest reflects the exact current content while preserving the lock model and approval policy.

• Regression coverage

  • Extended the focused governance validation check in tests/test_repository_validator_governance.py to include the repaired document set so the manifest remains aligned with the protected bytes going forward.

• Example

  {
    "path": "GEMINI.md",
    "expected_hash": "b4c9a970cb2f0a1cbdf1a215adc26484994063c34a970608f8a3977639748f1d",
    "sha256": "b4c9a970cb2f0a1cbdf1a215adc26484994063c34a970608f8a3977639748f1d"
  }

This is a narrow governance metadata repair: it restores lock integrity without changing the source documents themselves or broadening the scope beyond the mismatched protected entries.

• Fixes Phase A document-lock repair — human review required #22