fix(governance): eliminate token-boundary false positives and classify hidden settings

[Yesol-Pilot]

Purpose

Repair the reusable repository-governance gate after Einstein PR #191 exposed two trust defects:

1. the OpenAI pattern matched the sk- suffix inside ordinary identifiers such as task-source-provider-availability;
2. repository settings hidden from the workflow GITHUB_TOKEN were reported as confirmed mismatches with value None.

Changes

• move the reusable workflow logic into the tested neo_evidence_gate.repository_governance module;
• add left/right token boundaries plus length, character-diversity, entropy, and placeholder rejection;
• keep realistic provider-token and private-key detection fail-closed;
• add blob-SHA-bound synthetic fixture exceptions that expire and invalidate on any fixture edit;
• distinguish SETTINGS_MISMATCH from BLOCKED_ADMIN_AUDIT;
• allow the reusable CI check to return PASS_WITH_BLOCKED_ADMIN_AUDIT when code and current-tree checks pass but the workflow token cannot observe admin settings;
• continue printing those admin gaps as warnings rather than claiming settings PASS;
• update package metadata to the NeoGenesisAI/evidence-gate canonical repository;
• add regression coverage for task identifiers, short synthetic labels, realistic tokens, placeholder values, settings visibility, exact Einstein branch exception, blob drift, exception expiry, and clean evaluation.

Security boundary

• No path-wide secret exemption was added.
• Synthetic fixture exceptions are limited to test-like paths, exact Git blob SHA, exact secret labels, owner, reason, and expiry.
• A changed fixture blob is scanned again and fails closed.
• This gate scans the current tracked tree. It does not claim a full-history Gitleaks result.
• PASS_WITH_BLOCKED_ADMIN_AUDIT is not repository-settings compliance; a separate administrator readback remains mandatory.

Verification performed before push

• python -m pytest -q tests/test_repository_governance.py: 10 passed.
• python -m py_compile src/neo_evidence_gate/repository_governance.py: PASS.

Einstein follow-up

After this PR passes and merges, update Einstein PR #191 to call NeoGenesisAI/evidence-gate, add exact blob-bound fixture declarations for its dedicated redaction/security fixtures, and rerun governance. Unit-worker failure remains a separate CI defect and is not hidden by this change.