Adopt proof-pr v0.2.2 introduced metadata checks

[saagpatel]

Summary

• updates the reusable workflow and installed CLI pin to v0.2.2
• enables check_public_git_metadata
• uses public_git_metadata_mode: introduced so legacy public history does not block new-commit hygiene

Proof Bundle

Risk: T3
Receipt: proof-pr.v1 for e43dbb828dac97c928ad9806faf613f48190c1d2
Decision: ready_with_operator_awareness

Evidence:

• release-available: v0.2.2 release exists with validated receipt asset -> passed.
• workflow-update: reusable workflow and install ref both pin v0.2.2 -> passed.
• introduced-metadata-gate: check_public_git_metadata: true and public_git_metadata_mode: introduced -> passed.
• github-workflow-dispatch: passed (manual workflow passed on PR Adopt proof-pr v0.2.2 introduced metadata checks #70, including active introduced metadata check.)
• rollback: documented (revert this PR or pin back to v0.2.1.)

Known gaps:

• Full-history metadata cleanup remains deferred; this PR gates newly introduced commits only.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e43dbb828d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Use noreply metadata before enabling this gate

For the requested commit 282ccde, git show -s reports both author and committer as Codex <codex@openai.com>. In introduced mode, the v0.2.2 reusable workflow defaults the base to origin/main for workflow_dispatch and runs proof-pr check-public-git-metadata --base-ref ... --ref github.sha; that check fails on commit/tag email metadata outside GitHub noreply patterns. Manually dispatching this workflow on this PR/commit will therefore fail on the very commit that enables the gate, so the commit needs to be recreated/rebased with noreply author/committer metadata before this check is turned on.

Useful? React with 👍 / 👎.