governance(v21): authorize Product final materialization root closure - #392

Independent exact-head authorization review for d44eda92a06abfbc6207dabb5b35cdca2ec17a66 under the repository's CodeRabbit-rate-limit fallback rule. CodeRabbit explicitly did not start the exact-head review because the review limit was reached; no CodeRabbit conclusion is claimed. Final proposal transport is ahead 2 / behind 0 from trusted main 9aecf248d7b5462aecaa852bbc3fe881446eda86 and the net diff is exactly one new governance authorization JSON. The prior implementation-branch RED was traced to proposal schema only (74-character workPackage exceeded the generic 64-character bound and workflowModificationAllowed lacked the mandatory exact workflowModificationPolicy); revision 2 shortens only the work-package identifier and adds the exact existing Product Final workflow path/count/digest, without changing causal evidence or implementation scope. Recomputed canonical SHA-256 sets match all declarations: authorization path 2c1ff5e3d043f0a4132b9d2290a8990a0bbd548a8efdce7cdde711a2cfb3e598; six implementation paths 4d992807421a33b406085bbb216635b19676bfb4842b23de278af903c3ba8bd2; two failure-first tests b9a1039dd81be3c13aae079d214ebfd630e2e370c27e77a4f86bccc0ac431d56; Element build-overlay paths 8d8a75b92f724dbbc6ca22d8f5a2c0a3ce304db9358016fa5987b82b688eac54; rcedit custody paths 669730a1c8b75d7f16907f8643c36d6341ccfcab35450dab4aba601cac00cd27; workflow path eca1bb2482379a5df234b391747d035ddde2419b6072f6fd279a58239e4e0322. Scope is root-cause bounded: (1) reuse existing Matrix bootstrap overlay to materialize only the already-governed assistant-ui/tool-ui v2026.2.13 tree at the identical pinned Element build-workspace vendor path while LearningToolUiAdapter, module manifests/lockfiles/Vite/tsconfig/project, Element ModuleLoader, and 0012 package.json+lib-only runtime delivery remain unchanged; raw vendor source is not authorized for runtime delivery; (2) preserve the broad future vendor/rcedit/*.exe LFS rule but create a later exception only for the exact reviewed vendor/rcedit/rcedit-v2.0.0-x64.exe, keeping the existing official v2.0.0 asset identity, 1,360,384-byte size and SHA-256 3e7801db1a5edbec91b49a24a094aad776cb4515488ea5a4ca2289c400eade2a, and require native Git tracked-blob/worktree identity + size + hash verification with no Git LFS materialization, live download, retry, mirror, package-manager acquisition, source rebuild or alternate binary. No Product feature/runtime, dependency, manifest/lockfile, Learning adapter, Element runtime patch, WP7 implementation, UAT receipt/status, unrelated workflow, checksum/version, broad LFS disablement, cache/downloader or new general-purpose Yance infrastructure is authorized. Exact-head Stage 6.4.5.9 and Layered CI are GREEN; ACV2 is GREEN; Product Final is correctly skipped on this governance branch. Review threads are empty. P0/P1 blocking findings: 0. Merge remains gated on the remaining common exact-head Model Brain Windows run, a final fresh-main/head check, and explicit owner authorization required by this proposal.