supply-chain: gate automated submodule bumps on upstream and consumer validation

Confirmed gap

PR #1742 advances two vendored gitlinks in one automated update:

• MetaHarness: 33 commits
• RuVector: 257 commits

The two exact target commits have no attributable workflow run or combined commit status, and every RuView workflow on the PR is currently action_required, including CI, Security Scanning, CSI data policy, and the regression guard.

The gitlinks are immutable, so this is not a floating-ref claim. The gap is that the automation proposes a large, bundled dependency update without machine-verifiable upstream or consumer validation.

Impact

A reviewer cannot tell whether either upstream changeset independently preserves RuView's build, security, data-policy, firmware, native/WASM, and sensor contracts. Bundling both pointers also prevents fault attribution.

Acceptance criteria

1. Verify each target commit is reachable from the configured tracked branch.
2. Attach upstream exact-head CI/security status for each target commit.
3. Split independent submodule updates, or generate a per-submodule commit/change-risk receipt.
4. Run RuView CI, Security Scanning, CSI data policy, and regression guards on the proposed gitlink set.
5. Keep automated PRs unmergeable by policy until every required check completes successfully.
6. Record the old/new commit IDs and comparison links in the PR body.
7. Consider GitHub's supported gitsubmodule Dependabot ecosystem or an equivalent reviewable update mechanism rather than an unbounded multi-submodule branch-tip sweep.

Security classification

Supply-chain provenance and validation gap; no vulnerability or malicious upstream commit is alleged.

Start by reviewing PR #1742 and the existing CI, Security Scanning, CSI data policy, and regression guard workflows, including their current action_required results. Trace how automated submodule updates are proposed and how required checks control mergeability. Done means each target commit has upstream status, updates are independently attributable or receipted, all required consumer checks pass, and the PR records old/new commit IDs with comparison links.