Keep workflow context local

This patch keeps internal workflow context out of application changes and public handoffs.

Changes

• Require local session state and workflow attribution to stay out of application code, comments, commits, PRs, and published artifacts.
• Generate public PR drafts from validation totals without copying private descriptions, evidence identifiers, or local report paths.
• Exclude generated state through local Git configuration, including nested directories.
• Block the publication helper when local state is tracked, appears in outgoing commit history, or is referenced in PR text.
• Refresh both supported host bundles with matching guidance.

Validation and limits

Regression coverage checks public draft isolation, local exclusions, and blocked publication before remote writes. The release announcement records final local check results. Workflow attribution still requires inspection of code and public text; the automated checks cover local state paths. Maintained tooling definitions retain identifiers needed to implement the tool.

Updating

Update both host installations and restart their sessions to load the new instructions. GitHub Actions remains disabled.

Release process