[jonahgabriel]

What

Operator ruling: no deployment or lab configuration, overlays included, lives in a shipped repository, and the check that refuses it is a required CI context on every shipped repository ("This should be in ci."). omniclaude ships that check as the deployment-config job of its reusable hygiene workflow and as the exported deployment-config pre-commit hook.

This change makes omnidash produce the context public-repo-hygiene / deployment-config through the caller .github/workflows/public-repo-hygiene.yml, whose reusable-workflow pin moves to the omniclaude commit that carries the job, and the deployment-config pre-commit hook at the same revision.

The job reads no private vocabulary and uses no secret, so it runs on a fork pull request. It enforces on the lines a pull request adds; residue already on dev is reported, not failed.

The context is added to the repository's required status checks as a separate branch-protection or ruleset write, only after this pull request has run the job green on its head, so the repository is never frozen on a context that cannot report. Existing required contexts are kept.

Ticket: OMN-20940

Lab

Lab: host h201 (omninode-pc), lane config-out-8-9f8a-r, pushed head b07824113b8e, run through onex_lab_run.py --via ssh (the bus path needs ONEX_LAB_WORK_PYTHON, unset here). In a scratch worktree at origin/dev (623d3e6) I added docker/lane-overlays/proof.bifrost.yaml with a lab-shaped private address as its endpoint, then ran the gate at omniclaude 0c9f9146d8dd:

python3 scripts/public_repo_hygiene_gate.py --repo-root . --only-classes deployment-config --mode enforce --enforce-scope added-lines --diff-base origin/dev

• scratch worktree with the proof file: exit 1, 2 REFUSED (docker/lane-overlays/proof.bifrost.yaml).
• this pull request's head, same command: exit 0, clean.
• lab-run record: exit 0 in 3.3s.

Evidence-Ticket: OMN-20940
Evidence-Source: OCC#13696

[onexbot-occ-writer]

OCC autobind did not mint a companion for this PR: no changed-file candidate could be proven RED against the merge base, and emitting a PR-existence probe instead would be non-falsifiable evidence (OMN-15247). Hand-authored evidence is required.

Considered 3 changed file(s):

• .github/workflows/public-repo-hygiene.yml: no candidate grammar reads this file type (only Python declarations, uv.lock lines, release-artefact lines and contract-pin lines are proposed)
• .pre-commit-config.yaml: no candidate grammar reads this file type (only Python declarations, uv.lock lines, release-artefact lines and contract-pin lines are proposed)
• contracts/OMN-20940.yaml: no candidate grammar reads this file type (only Python declarations, uv.lock lines, release-artefact lines and contract-pin lines are proposed)

This verdict is occ-autobind's, derived from this head and its merge base alone. A second producer, the occ-companion-effect backstop, consumes its own command on the lab bus and may still mint a companion under the generic binding. Whether it does depends on that consumer running, not on this diff (OMN-18876).