Hold unapproved architectural feature proposals before recommending work

[laclance]

Finding

The October 9 scout report recommended feature proposals without an accepted implementation contract: containerd/containerd#14298 (unspecified snapshotter API), containerd/containerd#14315 (shared-netns proposal contingent on interface/ownership agreement), and grafana/loki#24731 (a proxy-controlled trusted log-label change).

Narrow fix

• Hold strategic proposals that explicitly leave an API unspecified, defer implementation until interface agreement, or propose reverse-proxy-controlled authentication labels through a new HTTP header.
• Treat project readiness labels and explicit trusted maintainer approval as positive acceptance; untrusted contributor encouragement is insufficient.
• Defer source-only preflight when issue comments have not yet been retrieved, preserving future maintainer approvals.
• Add direct readiness regression cases for all three examples, ordinary feature counterexamples, and app-level preflight and final verification coverage.
• Update architectural readiness documentation.

No paid lane, scan budget, state persistence, or report delivery changes. This prevents future recommendations; existing published reports and seen-state remain unchanged.

Validation

GitHub Actions quality and compatibility checks must pass before merge.

Draft PR against dev; do not merge without authorization.