Summary

Adds AIRK-GOV003, a conservative governance finding for instruction files that appear to encourage bypassing review, CI, branch protection, or safe integration boundaries.

Scope

• Adds review/CI bypass detection in agent_rules_kit.governance.
• Introduces find_governance_findings() as a stable aggregator so future governance rules do not get wired into the CLI one by one.
• Keeps AIRK-GOV006 behavior intact.
• Adds positive and negative tests for AIRK-GOV003.
• Adds CLI JSON coverage using the existing risky-instructions fixture.

Verification

• ./scripts/check.sh
• JSON smoke for tests/fixtures/repositories/risky-instructions
• JSON smoke for tests/fixtures/repositories/unsupported-claim
• clean fixture JSON smoke with finding_count: 0
• isolated build + wheel install smoke

Product boundary

This does not audit actual GitHub branch protection, CI settings, or repository permissions. It only reports conservative local findings from supported instruction files.

README is intentionally not changed in this phase.