fix(pingora): exempt documentation raster evidence

CHANGELOG.md

@@ -5,6 +5,9 @@ this file. The format follows Keep a Changelog, and versioned releases follow
 Semantic Versioning where the repository publishes a release.
 
 ## [Unreleased]
+- Validate final documentation PNG bytes through chunk, CRC, zlib-stream,
+  palette, dimension, and scanline contracts before granting the narrow
+  Pingora-policy documentation exception.
 - Harden the review sidecar's per-account catalog cap against silent drift:
   `contextual_orchestrator_review_launcher.py`'s two
   `build_zdr_prioritized_catalog` call sites now source their

docs/adr/0019-cloudflare-pingora-edge-standard.md

@@ -27,8 +27,10 @@ so a governed shared implementation is required.
    contracts. Environment deployment remains in `linux-cluster-ops`.
 4. The organization required workflow rejects active Nginx runtime artifacts in
    changed final files without executing pull-request code.
-5. Only dedicated source fixtures and the policy scanner may contain denied Nginx
-   samples; executable integration and end-to-end test helpers remain candidates
+5. Documentation prose, license text, dedicated source fixtures, the policy
+   scanner, and structurally validated PNG evidence beneath documentation directories
+   may contain denied Nginx samples. Image extensions alone do not establish the
+   exception; executable integration and end-to-end test helpers remain candidates
    for enforcement.
 6. Initial migration does not use Pingora's experimental cache integration.
 7. PHP workloads move to an HTTP application server or reviewed FastCGI adapter
@@ -66,5 +68,6 @@ so a governed shared implementation is required.
 
 The policy scanner has 100% production statement and branch coverage, bounded
 GitHub API evidence, path/control escaping, pagination limits, exact-head content
-inspection, and fail-closed malformed-evidence tests. Product migrations require
-site/proxy behavior tests and deployment-specific smoke tests before cutover.
+inspection, raster-format validation, and fail-closed malformed-evidence tests.
+Product migrations require site/proxy behavior tests and deployment-specific
+smoke tests before cutover.

docs/doctoring/pingora-edge-standard.md

@@ -20,8 +20,10 @@ dependencies. The initial CWL implementation avoids experimental cache APIs.
 - The shared artifact is Apache-2.0 compatible with CWL permissive-license policy.
 - Required-workflow code is bound to its immutable central SHA and never executes
   pull-request content.
-- Runtime evidence is bounded to one-megabyte UTF-8 regular files and a maximum of
-  3,000 changed files; missing or malformed evidence fails closed.
+- Runtime evidence is bounded to one-megabyte regular-file bytes, with UTF-8
+  decoding for runtime candidates and complete PNG chunk/CRC/zlib/scanline
+  validation for documentation images; the maximum is 3,000 changed files and missing or
+  malformed evidence fails closed.
 - Exact-head product tests cover host/path routing, SPA fallback, security headers,
   WebSocket/streaming, body limits, health, metrics, TLS, and graceful shutdown as
   applicable.

docs/policies/PINGORA_EDGE_POLICY.md

@@ -6,12 +6,15 @@ ContextualWisdomLab production and test edge runtimes use **Cloudflare Pingora**
 Active Nginx containers, packages, commands, configuration files, Kubernetes
 Nginx ingress annotations/classes, and host-service units are prohibited.
 
-This is a runtime boundary, not a vocabulary ban. Documentation, license notices,
+This is a runtime boundary, not a vocabulary ban. Documentation, recognized
+non-executable image evidence beneath a documentation directory, license notices,
 dedicated source fixtures under `tests/fixtures/`, the scanner source itself, and
-migration histories may name Nginx. Executable integration and end-to-end test
-helpers remain runtime candidates. Pull requests that modify a runtime candidate
-are evaluated against the final exact head file, so deleting a legacy artifact is
-allowed while preserving it or introducing a new one fails closed.
+migration histories may name Nginx. An image suffix alone is not an exception:
+final bounded bytes must be a structurally valid, completely decodable PNG. Executable integration
+and end-to-end test helpers remain runtime candidates. Pull requests that modify a
+runtime candidate are evaluated against the final exact head file, so deleting a
+legacy artifact is allowed while preserving it or introducing a new one fails
+closed.
 
 ## Why this is not a search-and-replace
 
@@ -51,10 +54,12 @@ route/site contracts. Product repositories do not fork proxy internals.
 
 The organization-required `required-workflow-bootstrap` job runs trusted
 base-branch scanner code at the immutable required-workflow SHA. It reads bounded
-changed-file metadata and final UTF-8 content through GitHub's REST API. It does
-not check out or execute pull-request content and receives only read permissions.
-Malformed, truncated, binary, symlink, oversized, or unavailable evidence fails
-closed.
+changed-file metadata and final file bytes through GitHub's REST API; runtime
+candidates must decode as UTF-8, while documentation PNG evidence must pass
+chunk-order, CRC, zlib-stream, dimension, and scanline validation and match
+its supported format. It does not check out or execute pull-request content and
+receives only read permissions. Malformed, truncated, unrecognized binary,
+symlink, oversized, or unavailable evidence fails closed.
 
 ## Exception process