[Epic]: The source-declaration gate — every telemetry source has a verified matrix row and a proven connector

### Summary

RFC-0003 §9 and ADR-0013 make **source enumeration the gate on implementation**: a source declares its matrix row before its code is written, and a connector's credential path is proven by test rather than asserted. Two orphans are each half of that gate with nowhere to sit.

### Intent

The declaration gate only works if someone owns it. Today one source (M365 Copilot) has a matrix row derived from **reasoning about an API nobody called**, and one shipped connector's GitHub-side auth path was filed as untested. Both are entry-criteria failures, not feature work — which is why neither fits #95 (IDE adoption telemetry) or #160 (inbound auth to our IdP).

Future vendor connectors (#98/#99/#100, which stay under #95) inherit this epic's bar without re-parenting.

### Children

- **#158** — spike: verify the M365 Copilot API surface before RFC-0003's row is trusted. Its matrix row still reads "no ticket" and its API surface is asserted, not verified.
- **#58** — test coverage for the GitHub App JWT / installation-token / Copilot fetch path. ⚠️ **Needs re-scoping before work starts** — see below.

### Acceptance Criteria

1. No row in RFC-0003's source matrix is derived from documentation alone. Every row is either backed by a real call against the vendor API with the response recorded, or explicitly marked **unverified**.
2. Every shipped connector's credential path has a test that fails first for the predicted reason.
3. A new source cannot be implemented before its matrix row exists — stated in RFC-0003 as the gate it already claims to be.

### Out of Scope

- Building any new vendor connector. Those are #99/#100 under #95.
- The acceptance-signal question (RFC-0003 §2a Correction 3) — that is #95's.

### Technical Context

⚠️ **#58's premise has been falsified since it was filed and it must be re-scoped, not worked as written.** `crates/governance-copilot/tests/retry.rs` now holds 6 tests covering `fetch_report` (5xx retry, 404 no-retry, bounded give-up, `Retry-After`) and `token_for_org`, driven by a first-party `tests/support/mock_github.rs`. Its suggested approach — add `wiremock`/`mockito` — is a direction **the codebase has explicitly rejected on supply-chain grounds, recorded in `Cargo.toml`**.

What is genuinely uncovered: (1) `AppAuth::app_jwt`'s claim shape (`iss`, `iat`, `exp = iat + 600`) — the mock never verifies the signature, so nothing pins it; (2) `installation_id` org matching for zero matches, multiple matches, and a case-differing `account.login` — the mock advertises exactly one login. Extend `MockGithub`; do not add a mock crate.

### AI Usage Declaration

Grouping identified and epic drafted by Claude Opus 5 during the 2026-09-01 triage sweep. #58's falsified premise was verified by reading `crates/governance-copilot/tests/` on `origin/main` — the tests it says do not exist are there. AI output is not truth; the owner verifies.