Enforce adversarial-review evidence as a PR completion gate

[Copilot]

Pull Request Template

📝 Summary

This update closes the gap between “review required” policy and enforceable behavior. It makes adversarial-review completion explicit in authoring guidance, visible in the PR contract, and validated in CI.

🔧 Changes

• Completion policy hardening
  • Updated .github/copilot-instructions.md Done Criteria to require running the adversarial reviewer agent before finalization.
  • Added explicit invocation guidance (task with agent_type: "adversarial-reviewer").
• PR contract update
  • Added a required checklist item in .github/pull_request_template.md:
    Adversarial reviewer run completed; findings resolved or documented.
• CI enforcement
  • Added a reviewer-evidence PR job in .github/workflows/ci.yml that fails when the required checklist line is not checked.
  • Added explicit workflow token permissions (contents: read) to satisfy workflow security constraints.

if ! printf '%s' "$PR_BODY" | grep -Eiq -- "- \[[xX]\] ${REVIEWER_CHECKLIST_TEXT}"; then
  echo "::error title=Missing reviewer evidence::Check the PR template item: '${REVIEWER_CHECKLIST_TEXT}'."
  exit 1
fi

🎯 Motivation

The repository already required adversarial review by instruction, but there was no durable, machine-checked signal that it was actually performed. These changes make that requirement auditable and enforceable at PR time.

🧪 Testing

📸 Screenshots (optional)

N/A (no UI/behavioral surface change).

✅ Checklist

• Code compiles and runs
• Tests added or updated (if applicable)
• Documentation updated (if needed)
• No linting or formatting issues
• Adversarial reviewer run completed; findings resolved or documented
• PR title is clear and descriptive

[Copilot]

Pull request overview

This PR strengthens the repository’s “adversarial review required” policy by making it explicit in authoring guidance, adding an explicit PR checklist attestation, and enforcing that attestation via CI on pull requests.

Changes:

• Adds a new CI job (reviewer-evidence) that fails PRs unless the “Adversarial reviewer…” checklist item is checked in the PR body.
• Updates the PR template to include the required adversarial-review evidence checklist item.
• Updates Copilot “Done Criteria” to explicitly instruct running the adversarial reviewer agent and documenting findings.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/ci.yml	Adds a PR-only gate job and sets explicit GITHUB_TOKEN permissions.
.github/pull_request_template.md	Adds a required checklist item for adversarial reviewer evidence.
.github/copilot-instructions.md	Makes adversarial-review execution and documentation explicit in completion criteria.