chore(release): promote develop to main (REP-60 bootstrap)

[litroc]

Normal human-authored develop-to-main promotion used once to establish the already reviewed canonical REP-60 pipeline trust root on protected main. This is a Draft and intentionally AI-free. It will be marked Ready exactly once only after deterministic checks settle, then reviewed once by pipeline Copilot on the unchanged final head. No candidate workflow certifies this PR; no bypass or force push.

[Copilot]

Pull request overview

Establishes the REP-60 / MLX-90 “current revision” governance model by moving review authority into protected GitHub Actions controllers, adding a bounded exact-revision materializer, and explicitly prohibiting any local AI egress in the push-ready workflow.

Changes:

• Add a new exact-revision materializer (scripts/materialize-exact-revision-review.py) to generate and re-verify a bounded, history-free review input.
• Enforce “no local AI egress” in lit-push-ready and update governance docs/config to reflect remote-only protected review policy.
• Rework protected workflows to dispatch/verify exact-revision Codex review and publish/refresh a neutral “Current revision review” check, including a rerun helper.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/materialize-exact-revision-review.py	New bounded exact-revision materializer + verifier for protected review inputs.
scripts/lit-push-ready.py	Removes local agent execution path; keeps deterministic local safeguards only.
renovate.json	Disables Renovate updates for shared-assets-owned workflow files downstream.
AGENTS.md	Documents REP-60 current-revision governance and AI review funding/eligibility rules.
.lit/push-ready.json	Updates required check/job name and disables local Copilot/Codex agents.
.github/workflows/sync-main-to-develop.yml	Hardens backmerge automation and records deterministic main ancestry evidence.
.github/workflows/shared-assets-guarded-automerge.yml	Tightens identity/provenance checks and excludes certain backmerge PRs in lightning-it/.github.
.github/workflows/renovate-guarded-automerge.yml	Makes auto-merge disabling more robust/verified before failing closed.
.github/workflows/release-bot-exact-head-review.yml	Replaced with protected workflow_dispatch-based Exact-Revision Codex controller + durable dedupe/recovery.
.github/workflows/promote-develop-to-main.yml	Binds promotions to the exact develop head and dispatches protected Exact-Revision review.
.github/workflows/current-revision-rerun.yml	New protected helper to rerun the single verifier attempt exactly once under strict bindings.
.github/workflows/copilot-review.yml	Converts gate to protected pull_request_target, enforces REP-60 policy, and publishes bound neutral results.
.github/workflows/copilot-review-refresh.yml	Reruns/invalidates stale/ambiguous neutral evidence and triggers canonical protected reruns as needed.
.github/workflows/codex-copilot-remediation.yml	Restricts remediation eligibility, removes automatic Copilot retry loop, and limits to one repair round.
.github/copilot-instructions.md	Updates pinned AGENTS_SHA256 to the new governance contract.
.github/codex/schemas/exact-head-review.schema.json	Expands binding fields (merge base, integration tree, diff hash, input hash) for exact-revision verification.
.github/codex/prompts/review-exact-head.md	Updates prompt to bind Codex output to the expanded immutable metadata set.
.github/codex/prompts/remediate-copilot.md	Clarifies full-thread retrieval and enforces a single bounded remediation package (no recursion).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.