Refuse a configure.sh Apply for an Unregistered Repository and Name the Develop Checkout for an Unpromoted Entry - #4082

…s Rule, Companion-Free Lint, Root hub_fetch_run, .codecov.yml (#4083)

## Summary

Promotes burndown round 3 of the attended run of 2026-11-10, together
with two pull requests from other hub sessions, from `develop` to
`main`.

- #4082: `configure.sh apply` refuses a repository the registry does not
list, before any write. A repository whose entry is on `develop` but not
yet on `main` is configured and audited from a hub checkout at
`develop`. `OPERATIONS.md`, `AUDIT.md`, `GOVERNANCE.md` "Hub-Hosted
Tooling", and the standup, audit, and branch-protection skill text now
say so.
- #4081: `WORKFLOW.md`'s contradictory trigger, merge, and release rules
are reconciled. D1.5 requires a gate to trigger on `pull_request`, and
the audit reports a gate that does not. A retarget is cleared by a push
or a close and reopen.
- #4078: `CODESTYLE.md` gains an Interrupts rule with Python and Shell
mechanics. `build_dist.py` no longer carries a file's trailing link
definitions into an include of its last heading.
- #4076: `docker_lint.py` imports only the standard library, so the Lint
tasks fetch no companions. The provenance label and the ruff task labels
are corrected. `GOVERNANCE.md` "Repo-Scoped Secrets" states the
owner-first host secret stem.
- #4080, from another session: `hub_fetch_run.py` lives in the
repository root for both hook shapes.
- #4077, from another session: only `.codecov.yml` is accepted as the
Codecov configuration name.

Fixes #4061
Fixes #4011
Fixes #4051
Fixes #4048
Fixes #4060
Fixes #3947
Fixes #4072
Fixes #3915
Fixes #4059
Fixes #4071

🤖 Generated with [Claude Code](https://claude.com/claude-code)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Documentation**
* Clarified when repository checks and configuration use the `develop`
branch, and documented that configuration changes are not applied to
unregistered repositories.
* Expanded scripting guidance for handling interruptions, cleaning up
resources, and saving persistent state safely.
* Updated workflow, coverage, and hook setup guidance to reflect current
requirements and locations.

* **Bug Fixes**
* Audits now check only the declared baseline filename; repositories
using a different filename are reported as missing.
* Markdown heading extraction no longer includes trailing link
definitions in the heading body.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

…ut (#4125)

## Summary

Addresses #4085, per the maintainer's answer there (option 1).
`scripts/carry.py` could not run `STANDUP.md` step 2 for a repository
whose registry entry had merged to `develop` but not yet reached `main`.
It refused any hub checkout not at `origin/main`, and the target's entry
was missing there.

- **`verify_hub` accepts `develop` for an unpromoted entry.** A hub
checkout at `origin/develop` is accepted when the target has no entry on
`origin/main`. It is refused for a target `main` already registers, so
every other carry stays on `main`. This matches
`repo-config/configure.sh` and `spec/audit.py` since #4082.
- **From `main`, a develop-only entry is named.** The run says to use a
`develop` checkout rather than reporting the repository unregistered.
- **Both branches are fetched by explicit refspec.** The hub menus clone
`main` with `--single-branch`, where a plain `git fetch origin main
develop` never creates `origin/develop`.
- **The menus stay main-only, as their own policy.** Their
`--ref`/`-Ref` refusal now names the unpromoted case and points at
running `scripts/carry.py` from a `develop` checkout. Their comments,
which stated the old carry.py rule, now state the menu's.
- **Docs agree.** `STANDUP.md` step 2, `GOVERNANCE.md` "Hub-Hosted
Tooling", `scripts/README.md` "`carry.py`", and `host-setup/README.md`.

`registry_matches` replaces the duplicate entry matching in
`resolve_repo`.

## Verification

- `tests/test_carry.py`: 85 tests pass. The new `CarryHubTests` build a
real two-branch hub and cover main, develop, the refusals both ways, a
checkout at neither, and a `--single-branch` main clone. Against the old
plain fetch, the single-branch case fails with `fatal: invalid object
name 'origin/develop'`, the defect it pins.
- Pre-commit gates clean: ruff format and check, mypy, prose gate, EOL.
`shellcheck host-setup/menu.sh` and a PowerShell parse of
`host-setup/menu.ps1` are clean.
- The menu change is a message string and comments only. `menu.ps1` was
parsed with `pwsh` on Linux, not run on native Windows.

## Labels

`comments`: the change corrects existing comments in both menus that the
new behavior made false.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>