chore: reconcile Bootstrap managed files

[jmcte]

Summary

• Reconcile the Flow repository's Bootstrap-managed governance and onboarding artifacts.
• Preserve the existing Python CodeQL declaration and make the required managed-path companions explicit.

Governing Issue

No governing issue is linked; this is a scheduled Bootstrap fleet reconciliation.

Validation

• Bootstrap plan and repo apply completed successfully in an isolated worktree.
• git diff --check passed.
• Repository fast checks are currently blocked by pre-existing project-specific contract expectations: the repository keeps a legacy github/pull_request_template.md alongside the generated .github/PULL_REQUEST_TEMPLATE.md, and its contract requires additional runner-selector and production-policy content not represented in the generic manifest.
• Required PR checks remain expected to run after the reconciliation is revised.
• External autoreview was not run because the authorized review scope covered the Bootstrap control-plane diff; local review was not treated as a substitute for the project-specific contract blocker.

Bootstrap Governance

• Changes are limited to Bootstrap-managed repository files and the manifest.
• No real credentials, runtime auth, sessions, caches, or machine-local environment files are included.
• GitHub settings and environments were not changed by this PR.

Merge Automation

Auto-merge is unsafe while the repository-specific fast-check contract is failing.

Risk Notes

Keep this PR in draft. The next revision must reconcile Flow's project-specific contract with the Bootstrap archetype before merge.

[athena-omt]

Request changes: this PR is not merge-ready. On the exact head, bash scripts/ci/run-fast-checks.sh fails because validate_repository_contract.py reports four violations: generated PR-template drift, missing required public runner selector documentation in AGENTS.md and onboarding, and missing immutable production-pin guidance in README.md. python3 -m unittest discover -s tests -v also fails at test_repository_contract_is_current. The live PR is a draft, is dirty against main, and merge-tree reports conflicts in .githooks/pre-commit, AGENTS.md, CONTRIBUTING.md, README.md, docs/bootstrap/onboarding.md, and project.bootstrap.yaml. Rebase onto current main, resolve those conflicts, reconcile the managed canonical/projected files and documentation with the contract, then rerun fast checks and the full test suite. Live named CodeQL checks are successful; no prior reviews or inline comments were returned by the public REST endpoints.