chore: ecosystem-wide sync of uncommitted changes

.planning/phases/01-enterprise-governance/01-REVIEW.md

@@ -0,0 +1,43 @@
+---
+phase: 01-enterprise-governance
+reviewed: 2026-07-11T13:55:00Z
+depth: deep
+files_reviewed: 5
+files_reviewed_list:
+  - .github/workflows/release-please-reusable.yml
+  - .github/workflows/release-please.yml
+  - docs/RELEASE_POLICY.md
+  - release-please-config.json
+  - .release-please-manifest.json
+findings:
+  critical: 0
+  warning: 0
+  info: 0
+  total: 0
+status: clean
+---
+
+# Phase 01: Code Review Report
+
+**Reviewed:** 2026-07-11T13:55:00Z
+**Depth:** deep
+**Files Reviewed:** 5
+**Status:** clean
+
+## Narrative Findings (AI reviewer)
+
+PASS.
+
+Verified against the submitted PR head (`b3cb8c121388f6af367aa64fa507282096522f83`) and current public GitHub documentation:
+
+- Same-repo reusable workflow syntax is valid. `.github/workflows/release-please.yml` now uses `./.github/workflows/release-please-reusable.yml`, which GitHub documents as the supported syntax for calling a reusable workflow from the same repository and same commit.
+- Manifest-mode release-please behavior is consistent with the action’s documented v4+ behavior. Removing the `workflow_call` `release-type` input and not passing `release-type` to `googleapis/release-please-action` is correct for manifest mode; strategy is derived from `release-please-config.json`.
+- Docs/runtime consistency holds for the changed scope. `docs/RELEASE_POLICY.md` now accurately describes the local-call exception for this repository, the manifest-driven `simple` strategy in `release-please-config.json`, and the `0.0.0` bootstrap baseline in `.release-please-manifest.json`. Public repo state also matches the zero-tag claim for `Coding-Autopilot-System/.github`.
+- No workflow security regression was found in this PR. The third-party action remains SHA-pinned, and switching this repository’s self-call from an owner/repo ref to a same-repo relative path keeps caller and callee on the same reviewed commit rather than loosening provenance.
+- Downstream compatibility check passed. Current public callers in the `Coding-Autopilot-System` org pin the reusable workflow by SHA and do not pass the removed `release-type` input, so this interface cleanup does not break their workflow syntax when they later repin.
+
+---
+
+_Reviewed: 2026-07-11T13:55:00Z_
+_Reviewer: the agent (gsd-code-reviewer)_
+_Depth: deep_