main
feat: add SecOps guidance and distribution marker
feat: require approval for contract extensions
feat: add fail-closed project process gate
fix: pin checkout action to full SHA