[vitormattos]

Summary

Pin the governance engine to a signed, immutable revision with safe reporting of GitHub ruleset bypass actors.

The public GitHub API hides bypass_actors when the token does not have write permission to rulesets. Automatic Plan now reports UNVERIFIED instead of false drift when bypass values cannot be examined, while preserving genuine observable drift. Privileged Apply stays manual and protected by ruleset-sync; the engine refuses to apply if bypass actors are hidden.

Dependency

• Merge fix: distinguish redacted bypass actors from real drift LibreCodeCoop/github-governance#38 first.
• That PR contains 59 passing Vitest tests, TypeScript checks, build, and node syntax compatibility checks.
• No changes to actors, approval policy, or App credentials in this caller PR.

Next step

Run a complete authenticated read-only plan using the maintainer's GitHub CLI token, then authorize manual, environment-protected Apply. The automatic Plan is informative but never authoritative for bypass actor equality.