ci(docs): enforce governed knowledge records - #369

方向对，覆盖面不够

docs/README.md 治理的是 research、design、architecture、Decision、benchmarks。检查器只扫了 docs/research 和 docs/benchmarks。#386/#382 这种 validated 的 architecture/design 记录现在不会被拦。

请扩到 design / architecture / Decision，或明确写「其余类别暂不强制」并改 README。#309 是 Decision-only 且 Windows 路径 fail-open，请吸收进来，不要并排合。

frontmatter 选择加入、「结构 ≠ 验证」是对的。

Exact-head review: 81320b2

[P1] The new CI contract is opt-out, so it does not enforce the forward-only policy for new records. scripts/check-knowledge-contract.mjs:136-142 classifies every frontmatter-less research/benchmark Markdown file as legacy and skips it. A contributor can therefore add a brand-new record without frontmatter and bypass required metadata, index reachability, links, frozen identities, accounting, failures, limitations, and evidence checks while bun run check remains green.

Decision 0001 says documents from that Decision forward are governed; legacy is a fixed historical set, not a property a new file may claim by omitting metadata. Please encode an immutable legacy allowlist or baseline and fail closed for every new unlisted record. Add a regression proving that a newly added frontmatter-less record fails, while the enumerated pre-Decision records remain accepted.

Verification boundary: exact-head checker/policy review. Existing tests intentionally assert the bypass as legacy exclusion, so their green result confirms rather than mitigates the issue.

Follow-up review of 3dd872b: the previously reported frontmatter opt-out P1 is addressed by the fixed LEGACY_RECORDS allowlist and the new rejection regression. I reran node --test --experimental-strip-types tests/scripts/knowledge-contract.test.ts in an isolated exact-head worktree: 6 passed, 0 failed (exit 0). This does not constitute full approval or evidence validation.

Please synchronize the remaining opt-in wording in the PR description and Research index with the implementation. The checker currently covers research/benchmarks only; retain an explicit statement of that enforcement scope. The required Windows CI is still red: job 101235332304 reports Timed out waiting for local git info in tests/extensions/git-info/index.test.ts. I have not established that failure as a product regression or a flake; refresh against main and obtain a green required matrix before merge.