Add AI-assisted development governance and enforceable quality gates

## Objective

Strengthen and regulate the use of AI-assisted development in the project by defining project rules and enforcing quality gates that protect correctness, efficiency, performance, security, and maintainability.

## Context

AI tools can accelerate implementation, review, documentation, and test generation, but they also increase the risk of shallow changes, unverified assumptions, duplicated abstractions, inaccurate docs, and code that passes locally while weakening long-term quality.

The goal is not to ban AI usage. The goal is to make AI-assisted contributions observable, disciplined, and subject to the same or stronger engineering gates as human-written code. Runtime performance and correctness must not depend on AI-specific mechanisms.

## Deliverables

- [ ] Add a project AI usage policy for contributors and maintainers.
- [ ] Define rules for AI-assisted code changes:
- No unverified generated code.
- No generated dependencies without justification.
- No security/auth/crypto/storage changes without explicit tests and reviewer attention.
- No runtime AI dependency in server behavior unless accepted through a separate design issue.
- No generated documentation that drifts from code/config/CI.
- [ ] Add repository guidance files for AI agents and contributors where appropriate, such as `AGENTS.md`, PR template checkboxes, and documentation references.
- [ ] Enforce quality gates in CI rather than relying only on policy text:
- Formatting, clippy, tests, docs, cargo vet/deny/audit, typos, markdown lint, TOML/YAML lint.
- Domain purity checks and feature-matrix checks.
- Required test/docs updates for touched areas where practical.
- [ ] Identify which gates should become required GitHub branch-protection status checks.
- [ ] Add CODEOWNERS or reviewer routing for high-risk areas such as auth, crypto, certificate management, secrets, storage, CI, and deployment.
- [ ] Add a lightweight AI-assisted-change checklist to the PR template.
- [ ] Document how maintainers should review AI-assisted PRs, including how to ask for evidence, tests, and simplification.

## Acceptance Criteria

- [ ] Contributors have a clear written policy for acceptable AI usage.
- [ ] AI-assisted PRs must explicitly state what was generated or assisted and how it was verified.
- [ ] High-risk code paths have reviewer routing or required review guidance.
- [ ] CI contains enforceable gates that cannot be bypassed by local agent behavior.
- [ ] Branch protection guidance identifies the required checks that repository admins should enable.
- [ ] The policy does not add runtime overhead or server behavior changes.
- [ ] The policy supports productivity while preserving correctness, performance, security, and maintainability.

## Verification

- [ ] PR template renders correctly.
- [ ] CI gates run on a test PR.
- [ ] Maintainer review confirms the AI policy is actionable and not merely aspirational.
- [ ] No runtime dependencies or server hot-path changes are introduced by this governance work.

## Notes

Some enforcement cannot be fully guaranteed from repository files alone. GitHub branch protection, required reviews, and required status checks must be configured at the repository settings level. This issue should document the exact settings maintainers need to enable.

Start by reviewing the repository’s governance and contribution files mentioned (`AGENTS.md`, PR template, `CODEOWNERS`) and current `.github/workflows` configs to map what checks already exist. Update AI policy and checklist docs there, then add or adjust enforceable CI checks (lint/test/security/gate checks) in workflow definitions. Add explicit branch-protection guidance for required status checks and high-risk review routing, and validate with a test PR that failures are surfaced and block merge as expected.

由索引模型根據 Issue 內容生成。