fix(scheduler): admit governance-risk-compliance via the org variable, not a hardcode

.github/workflows/pr-review-fix-scheduler.yml

@@ -101,11 +101,7 @@ jobs:
           DISPATCH_ACTOR: ${{ github.triggering_actor }}
           DISPATCH_SENDER: ${{ github.event.sender.login || '' }}
           ALLOWED_DISPATCH_ACTOR: ${{ vars.OPENCODE_REPOSITORY_DISPATCH_ACTOR }}
-          # The org variable remains the source of truth; this approved caller is
-          # included here until the variable's propagation catches up with its
-          # existing hourly caller. An empty variable therefore still permits only
-          # this exact repository, never an arbitrary target.
-          ALLOWED_TARGET_REPOSITORIES: ${{ vars.OPENCODE_REPOSITORY_DISPATCH_TARGETS }},ContextualWisdomLab/governance-risk-compliance
+          ALLOWED_TARGET_REPOSITORIES: ${{ vars.OPENCODE_REPOSITORY_DISPATCH_TARGETS }}
         run: |
           set -euo pipefail
 

.github/workflows/pr-review-merge-scheduler.yml

@@ -255,11 +255,7 @@ jobs:
           TARGET_REPOSITORY_INPUT: ${{ github.event.client_payload.target_repository || '' }}
           TARGET_PR_NUMBER: ${{ github.event.client_payload.pr_number || '' }}
           TARGET_BASE_BRANCH_INPUT: ${{ github.event.client_payload.base_branch || '' }}
-          # The org variable remains the source of truth; this approved caller is
-          # included here until the variable's propagation catches up with its
-          # existing hourly caller. An empty variable therefore still permits only
-          # this exact repository, never an arbitrary target.
-          ALLOWED_TARGET_REPOSITORIES: ${{ vars.OPENCODE_REPOSITORY_DISPATCH_TARGETS }},ContextualWisdomLab/governance-risk-compliance
+          ALLOWED_TARGET_REPOSITORIES: ${{ vars.OPENCODE_REPOSITORY_DISPATCH_TARGETS }}
         run: |
           set -euo pipefail
 

CHANGELOG.md

@@ -4,7 +4,7 @@
 
 ### Scheduler target admission
 
-- Added the existing `ContextualWisdomLab/governance-risk-compliance` hourly caller to both central scheduler validation surfaces. The organization variable remains authoritative; the literal is a narrow propagation bridge so the scheduled repair loop no longer fails before it can inspect the repository.
+- Added `ContextualWisdomLab/governance-risk-compliance` to the `OPENCODE_REPOSITORY_DISPATCH_TARGETS` repository variable directly (the actual source of truth for `ALLOWED_TARGET_REPOSITORIES` in both scheduler workflows) and removed the temporary hardcoded-literal bridge a prior commit had added to `pr-review-merge-scheduler.yml`/`pr-review-fix-scheduler.yml` to work around the variable not yet including it. Hardcoding a specific product repository into these shared scheduler workflows violates this repo's own thin-caller convention (`CLAUDE.md`: "Product hourly callers stay thin. Do not hard-code OriginWeave, aFIPC, naruon, or Keyverse into `pr-review-fix-scheduler.yml`") and broke `test_no_target_repository_is_hard_coded_in_the_shared_scheduler`. Updating the variable achieves the same admission with no code change and no test regression.
 
 ## [Unreleased]