ci(af01): add posture proof and main enforcement

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+# AF-01 trusted workflow/governance ownership boundary.
+# GitHub evaluates CODEOWNERS from the pull request base branch, so a PR cannot
+# weaken these ownership requirements by editing this file in the same change.
+/.github/ @TheHalfMoon

.github/dependabot.yml

@@ -0,0 +1,28 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: maven
+    directory: /tools/hl7-oracle
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5

.github/main-review-ruleset.json

@@ -0,0 +1,35 @@
+{
+  "name": "commandF main review governance",
+  "target": "branch",
+  "enforcement": "active",
+  "bypass_actors": [
+    {
+      "actor_id": 5,
+      "actor_type": "RepositoryRole",
+      "bypass_mode": "pull_request"
+    }
+  ],
+  "conditions": {
+    "ref_name": {
+      "include": [
+        "refs/heads/main"
+      ],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "pull_request",
+      "parameters": {
+        "allowed_merge_methods": [
+          "merge"
+        ],
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": true,
+        "require_last_push_approval": true,
+        "required_approving_review_count": 1,
+        "required_review_thread_resolution": true
+      }
+    }
+  ]
+}

.github/main-ruleset.json

@@ -0,0 +1,43 @@
+{
+  "name": "commandF main assurance",
+  "target": "branch",
+  "enforcement": "active",
+  "bypass_actors": [],
+  "conditions": {
+    "ref_name": {
+      "include": [
+        "refs/heads/main"
+      ],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          {
+            "context": "rust",
+            "integration_id": 15368
+          },
+          {
+            "context": "assurance-proof",
+            "integration_id": 15368
+          },
+          {
+            "context": "scorecard",
+            "integration_id": 15368
+          }
+        ],
+        "strict_required_status_checks_policy": true
+      }
+    }
+  ]
+}

.github/required-checks.json

@@ -0,0 +1,24 @@
+{
+  "schema": 1,
+  "protected_branch": "main",
+  "checks": [
+    {
+      "context": "rust",
+      "integration_id": 15368,
+      "workflow": ".github/workflows/ci.yml",
+      "job": "rust"
+    },
+    {
+      "context": "assurance-proof",
+      "integration_id": 15368,
+      "workflow": ".github/workflows/af01-assurance-proof.yml",
+      "job": "assurance-proof"
+    },
+    {
+      "context": "scorecard",
+      "integration_id": 15368,
+      "workflow": ".github/workflows/af01-scorecard.yml",
+      "job": "scorecard"
+    }
+  ]
+}