feat(governance): establish the OpenCoven organization control plane

.github/CODEOWNERS

@@ -0,0 +1,17 @@
+# Bootstrap ownership. Ruleset enforcement is tracked in OpenCoven/.github#6.
+* @BunsDev
+
+/AGENTS.md @BunsDev
+/governance/ @BunsDev
+/initiatives/ @BunsDev
+/decisions/ @BunsDev
+/compatibility/ @BunsDev
+/policies/ @BunsDev
+/schemas/ @BunsDev
+/scripts/ @BunsDev
+/tests/ @BunsDev
+/.github/workflows/ @BunsDev
+/.github/CODEOWNERS @BunsDev
+/SECURITY.md @BunsDev
+/PROVENANCE.md @BunsDev
+/PATENTS @BunsDev

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "13:00"
+      timezone: America/Chicago
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - governance
+    commit-message:
+      prefix: chore(actions)

.github/workflows/governance-ci.yml

@@ -0,0 +1,27 @@
+name: Governance CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: governance-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out reviewed source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - name: Run deterministic governance gate
+        run: ./scripts/agent-check fast

.github/workflows/governance-drift.yml

@@ -0,0 +1,32 @@
+name: Governance drift
+
+on:
+  schedule:
+    - cron: "17 13 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+concurrency:
+  group: governance-public-drift
+  cancel-in-progress: false
+
+jobs:
+  reconcile:
+    name: reconcile-public-inventory
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out governance source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - name: Reconcile public GitHub metadata
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: >-
+          python3 scripts/governance.py reconcile-github
+          --org OpenCoven
+          --repository OpenCoven/.github