[jonahgabriel]

What

Operator ruling: no deployment or lab configuration, overlays included, lives in a shipped repository, and the check that refuses it is a required CI context on every shipped repository ("This should be in ci."). omniclaude ships that check as the deployment-config job of its reusable hygiene workflow and as the exported deployment-config pre-commit hook.

This change makes omnibase_core produce the context public-repo-hygiene / deployment-config through the new public-repo-hygiene job in .github/workflows/ci.yml (a job in the existing workflow, because the pull-request-workflow ratchet admits no new workflow file), with .public-repo-hygiene.yaml adopted in report mode, and the deployment-config pre-commit hook at the same revision (declared in the existing omniclaude block that carries the secrets-baseline-wired hook and moves to this revision, because the canonical-file-shape ratchet admits no new suppression comment and detect-secrets flags a new revision line).

The job reads no private vocabulary and uses no secret, so it runs on a fork pull request. It enforces on the lines a pull request adds; residue already on dev is reported, not failed.

The context is added to the repository's required status checks as a separate branch-protection or ruleset write, only after this pull request has run the job green on its head, so the repository is never frozen on a context that cannot report. Existing required contexts are kept.

Ticket: OMN-20940

Lab

Lab: host h201 (omninode-pc), lane config-out-8-9f8a-r, pushed head 97c6ead77aae, run through onex_lab_run.py --via ssh (the bus path needs ONEX_LAB_WORK_PYTHON, unset here). In a scratch worktree at origin/dev (60ce70d) I added docker/lane-overlays/proof.bifrost.yaml with a lab-shaped private address as its endpoint, then ran the gate at omniclaude 0c9f9146d8dd:

python3 scripts/public_repo_hygiene_gate.py --repo-root . --only-classes deployment-config --mode enforce --enforce-scope added-lines --diff-base origin/dev

• scratch worktree with the proof file: exit 1, 2 REFUSED (docker/lane-overlays/proof.bifrost.yaml).
• this pull request's head, same command: exit 0, clean.
• lab-run record: exit 0 in 4.8s.

Evidence-Ticket: OMN-20940
Evidence-Source: OCC#13693

[onexbot-occ-writer]

OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required.

Considered 4 changed file(s):

• .github/workflows/ci.yml: no candidate grammar reads this file type (only Python declarations, uv.lock lines, release-artefact lines and contract-pin lines are proposed)
• .pre-commit-config.yaml: no candidate grammar reads this file type (only Python declarations, uv.lock lines, release-artefact lines and contract-pin lines are proposed)
• .public-repo-hygiene.yaml: no candidate grammar reads this file type (only Python declarations, uv.lock lines, release-artefact lines and contract-pin lines are proposed)
• contracts/OMN-20940.yaml: no candidate grammar reads this file type (only Python declarations, uv.lock lines, release-artefact lines and contract-pin lines are proposed)

This verdict is occ-autobind's, derived from this head and its merge base alone. A second producer, the occ-companion-effect backstop, consumes its own command on the lab bus and may still mint a companion under the generic binding. Whether it does depends on that consumer running, not on this diff (OMN-18876).