docs(governance): fix workflow catalog, Actions allow-list, and locked-count drift

[bryanfawcett]

Summary

Routine maintenance audit of the org-governing .github repo. The repo is already heavily maintained (SHA-pinned actions, SLSA provenance, quarterly settings audit, etc.), so rather than re-deriving already-current dependency pins, this PR fixes three concrete cases of documentation/config drifting out of sync with the actual state of the repo:

• README.md: the reusable-workflow catalog table was missing three workflows that already ship in .github/workflows/: reusable-ci-typescript-lib.yml, reusable-ci-terraform.yml, and reusable-ci-docker.yml. Added rows describing each, matching the style of existing entries.
• ORG_SETTINGS.md:
  • The Actions allow-list (Settings → Actions → General → Allow specified actions) was missing hashicorp/setup-terraform@* and terraform-linters/setup-tflint@*, both of which reusable-ci-terraform.yml actually uses. Under the "allow select actions only" policy this document declares, those two actions would be blocked from running. Added them to the allow-list, consistent with the existing entries for the OpenTofu/Docker equivalents.
  • The ruleset audit notes described main-branch-protection.json as "2-approver" and org-wide-main-protection.json as "1-approver." Both ruleset JSON files actually set required_approving_review_count: 0 (the documented pre-scale posture from the branch-protection table earlier in the same file). Corrected the prose to match the JSON.
• .github/PULL_REQUEST_TEMPLATE.md: the NA-03 merge-blocker checklist still listed "7 Enterprise products" as a locked count. NA-03 v1.6 explicitly removed that line — the Enterprise product line is uncapped and grows over time (also called out in this repo's CLAUDE.md). Updated the checklist to match NA-03 §3.3 and added a note so contributors don't re-add the cap.

No workflow logic, action pins, or governance substance changed — only documentation/config brought back in sync with what's already true.

Linked issue(s)

N/A — found via a full-repo maintenance audit, not tracked by an existing issue.

Type of change

• docs — documentation only

Breaking change?

• This PR introduces a breaking change.

How has this been tested?

• Verified the three "missing" workflows exist and read their on: workflow_call inputs to write accurate one-line descriptions.
• Verified the Actions allow-list gap by running grep -rhoE 'uses: [^@[:space:]]+' .github/workflows/ | sort -u (the exact audit command this repo's own ORG_SETTINGS.md documents) and diffing against the allow-list.
• Verified the ruleset drift by reading github-rulesets/main-branch-protection.json and github-rulesets/org-wide-main-protection.json directly.
• Verified the locked-count drift by grepping the repo for every "Enterprise products" reference and confirming NA-03 v1.6's changelog entry.
• Ran prettier --check (v3.9.4, matching reusable-lint.yml's pin) and markdownlint-cli2 (v0.18.1) against every changed file — both pass with zero findings.

Checklist

Process

• My PR title follows Conventional Commits.
• All of my commits are signed (SSH) and DCO-signed-off (git commit -s, using the human operator's identity).
• My branch name follows the claude/<topic>-<suffix> reserved prefix.
• I have rebased onto the latest default branch; no merge commits.
• Tests — N/A, documentation-only change.
• I have updated documentation (this PR is the documentation fix).
• I ran the repo's local checks (prettier, markdownlint) and they pass.
• New runtime dependencies — N/A.
• Breaking change — N/A.

NA-03 merge blockers

• Secret hygiene — confirmed no secrets appear anywhere in the diff.
• Prohibited dependencies — N/A, no dependency changes.
• Schema.org compliance — N/A, no schema/API changes.
• Locked counts respected — this PR corrects a locked-count drift (removes the stale "7 Enterprise products" line per NA-03 v1.6) rather than introducing one.
• Frontier defaults — N/A, no infrastructure behavior changed.
• New GitHub Actions — N/A, no new actions added to any workflow; the two actions added to the allow-list were already in use.

Additional notes

Opened as a draft per this repo's CLAUDE.md default for human-initiated review. Happy to fold in any further drift the maintainer wants addressed in the same PR.

---

Generated by Claude Code