docs(webkit): refresh GOVERNANCE_IMPLEMENTATION for release-please and the current CI pipeline

[robsongajunior]

Summary

Refreshes packages/webkit/docs/GOVERNANCE_IMPLEMENTATION.md — the governance-tooling rationale doc that ships to npm (package.json#files includes docs). It was a 2026-04 snapshot, resurrected by #768 after #741 deleted it, and had drifted from the tree on several load-bearing claims. Every statement in the refresh was verified against the current configs/workflows.

What was stale → what it says now:

• .d.ts-at-publish mechanism — claimed .releaserc prepareCmd (semantic-release, deleted by ci: replace semantic-release with release-please (Release PR model) #798). Now: the publish workflow (package-webkit.yml) runs vue-tsc --declaration --emitDeclarationOnly immediately before npm publish, triggered by release-please's release: published.
• CI section — described an 8-job pipeline triggering on main and dev. Now: the current 12-job governance.yml (adds lint-canary, smoke, tests ×4 shards, visual ×4 shards, each with a rationale subsection), main-only triggers, PR concurrency cancellation.
• Security audit — claimed pnpm audit --audit-level=high. Now: plain pnpm audit (any severity fails; accepted risks live as pnpm-workspace.yaml overrides).
• Config locations — ESLint flat config is the repo root file (packages/webkit/eslint.config.js is a one-line re-export) with hand-picked Vue rules rather than a spread preset; stylelint is the root .stylelintrc.json only; TS strictness is split across tsconfig.base.json + the webkit tsconfig (which also drives publish-time declaration emit).
• Scripts & hooks — documents the root webkit:* delegation scripts, the governance-gate scripts (catalog:check, size, pack:check, test:gate, authoring, doc-standards, smoke:consume), the Vitest browser-mode test scripts, and the commit-msg/commitlint hook. The old "skip hooks with --no-verify in emergencies" tip is replaced with the git-workflow prohibition.
• Housekeeping — a past-tense "Release Automation (2026-07)" migration note; "Future Improvements" split into shipped (bundle budgets, visual regression, functional tests, lint canaries) vs. still open; header carries "Implemented 2026-04-13 · Last refreshed 2026-07-28".

Closes #819 (the "refresh or delete" decision → refresh).

Notes

• Docs-only (docs type — no release on its own). No new dependencies. Not breaking.
• Overlaps docs: purge dangling .releaserc / semantic-release mentions (release-please follow-up) #818 (repo-wide .releaserc-mention purge): this PR resolves the GOVERNANCE_IMPLEMENTATION.md row. The refreshed Migration Notes deliberately keep one past-tense mention of semantic-release/.releaserc for historical context — the same category as release-types.md's don't-do-this notes — so docs: purge dangling .releaserc / semantic-release mentions (release-please follow-up) #818's acceptance grep gains one intentional hit.