Enable Hard-Fail Governance After Benchmark Gate

## Goal
Switch from rollout mode to enforced governance once benchmark criteria are met.

## Why
Hard-fail enforcement must be tied to measurable readiness, not calendar-based pressure.

## Preconditions
- Benchmark suite running on defined cadence.
- Approved KPI thresholds for Lane A (mandatory path).
- Waiver governance process active and auditable.

## Tasks
- Define required benchmark pass conditions and confidence window.
- Enable required status checks in protected branches.
- Freeze approved toolchain/agent versions for the cycle.
- Define controlled upgrade process and requalification trigger.
- Define rollback trigger if KPI health degrades after cutover.

## Governance Rule
Merge decisions for hard-fail mode are derived from Lane A policy results. Optional accelerator lanes cannot override Lane A deny decisions.

## Done When
- Hard-fail checks are mandatory in target repos.
- Upgrade/requalification process is documented and active.
- Post-cutover monitoring is active with rollback criteria.

Parent: eclipse-score/score#2852