[P1] Enforce Issue → branch → PR → Verifier delivery workflow

[fxbin]

Parent: #2

Problem

TopicEye already has repository engineering guidance, but recent delivery history does not consistently demonstrate the virtual-intelligent-dev-team GitHub loop. Direct-to-main commits reduce reviewability, regression isolation and parallel-worker safety.

WorkOrder

Lead: Git Workflow Guardian / Conductor

Scope

1. Define branch naming: issue-<number>-<short-slug> (or equivalent documented convention).
2. Require meaningful changes to have a GitHub Issue with context, scope, non-goals, acceptance criteria and verification plan.
3. Require PRs to link the issue and include Worker evidence.
4. Add/standardize PR template sections: WorkOrder, changes, tests, risks/rollback, verifier verdict, DeliveryCycleReport.
5. Document independent verification policy: Verifier must not be the same implementation pass; remediation goes back to Worker and is re-verified.
6. Require green required checks before merge where repository permissions/settings allow it.
7. Document emergency/hotfix exception procedure and post-hoc audit requirement.

Acceptance criteria

• Workflow contract is committed to repository documentation.
• PR template encodes Worker → Verifier → DeliveryCycleReport.
• New implementation work in this stabilization cycle uses issue-linked branches and PRs.
• Direct-to-main delivery is no longer the normal path.
• Branch-protection/ruleset configuration is reviewed by a repository admin; if automation cannot inspect/change it, the required manual setting is recorded explicitly.

Note

The connected GitHub App returned 403 when reading branch protection, so this issue does not assume the current protection state.

[fxbin]

Worker implementation is now in Draft PR #9 on branch issue-7-github-delivery-workflow.

Changes: .github/pull_request_template.md + docs/development-workflow.md.

Worker status: complete for documented scope. Independent Verifier verdict remains PENDING; do not merge solely on this Worker pass. Repository-admin branch-protection/ruleset review remains a follow-up because the GitHub integration cannot read that setting endpoint.