feat(hookify): codify DeploymentGovernance canonical policies from chittyagent-tasks incident

[Copilot]

chittyagent-tasks worker v1.2.0 was deployed ahead of main while a migration freeze was active, causing every createTask call to fail with column "notify_policy" does not exist. The Foundation layer had no canonical contract preventing this class of drift.

Changes

• packages/hookify/src/index.js — adds DeploymentGovernance class with four canonical policies distilled from the incident:

Policy ID	Enforcement	Guard
deploy-from-main	block	commit must be reachable from origin/main
version-pin	block	declared V constant must match tag/commit
migration-freeze-interlock	block	no new column refs while freeze notice is present
beacon-mismatch-alert	alert	deployed version absent from main-branch git log

• DeploymentGovernance is exported alongside the existing HookContract, HookRegistry, HookGovernance exports — downstream implementations (CHITTYOS/chittyops) consume it to enforce these gates in CI.

• .gitignore — adds exclusions for node_modules/, package-lock.json, dist/.

Usage

import { DeploymentGovernance } from '@chittyfoundation/hookify';

const gov = new DeploymentGovernance();
const result = gov.checkDeployment({
  onMain: false,               // not on main
  versionMatches: true,
  migrationFreezeActive: true,
  addsNewColumnRefs: true,     // adds notify_policy ref
});
// result.allowed === false
// result.blocked → [deploy-from-main, migration-freeze-interlock]

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2947779270

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Evaluate beacon-mismatch-alert in deployment checks

The new class declares beacon-mismatch-alert as a canonical policy, but checkDeployment has no input or rule to detect when a deployed version is missing from main, so callers relying on this method cannot emit the required alert for that drift scenario. This means one of the four documented incident-derived policies is effectively unenforceable through the provided evaluation API.

Useful? React with 👍 / 👎.