docs(governance): record protected PR workflow evidence

docs/RESIDUAL_RISKS_RU.md

@@ -50,26 +50,31 @@ visibility, release evidence contour and legal package. Они требуют д
 
 ## 2. Нет внешнего visible peer review / публично видимого peer review
 
-- Текущий статус: риск открыт; PR template, CODEOWNERS, public governance
-  issues and PR workflow docs exist, but first reviewed PR evidence and branch
-  protection verification are still pending.
+- Текущий статус: риск открыт частично; PR template, CODEOWNERS, public
+  governance issues, PR workflow docs and verified active GitHub ruleset for
+  `main` exist. PR #50 has run through protected checks, but first reviewed PR
+  evidence is still pending because review/merge is not complete.
 - Влияние: внешним аудиторам сложнее оценить review discipline and change
   control maturity.
 - Почему не блокирует pilot/readiness stage: current changes are protected by
   reproducible checks, public workflows and documented conservative positioning.
 - Как риск будет снижаться: review checklist, CODEOWNERS routing, public issue
-  #48, `docs/PR_REVIEW_WORKFLOW_RU.md`, first public reviewed PR evidence,
-  explicit release branch review policy and verified branch protection evidence.
+  #48, `docs/PR_REVIEW_WORKFLOW_RU.md`, first public reviewed PR evidence and
+  explicit release branch review policy.
 - Уже снижающие evidence/documents/CI: `.github/pull_request_template.md`,
   `.github/CODEOWNERS`, `.github/ISSUE_TEMPLATE/`,
   `docs/REVIEW_CHECKLIST_RU.md`, `docs/BRANCH_PROTECTION_POLICY_RU.md`,
   `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`,
   `docs/PR_REVIEW_WORKFLOW_RU.md`, `docs/PR_REVIEW_EVIDENCE_RU.md`,
   `CONTRIBUTING.md`, `SECURITY.md`, public CI, public security workflow.
-- Residual risk: remains open until branch protection is verified and first
-  reviewed PR evidence exists.
-- Следующий action: выполнить maintainer verification for branch protection and
-  record first reviewed PR evidence without overstating external peer review.
+- Branch protection pending risk: mitigated by verified active GitHub ruleset
+  for `main` with empty bypass list, required PR review, Code Owners review,
+  required status checks and force-push blocking.
+- PR workflow risk: remains open until PR #50 or a later PR is reviewed and
+  merged without bypass.
+- Residual risk: remains open until first reviewed PR evidence exists.
+- Следующий action: record first reviewed PR evidence without overstating
+  external peer review.
 
 ## 3. Низкая публичная активность issue tracker
 
@@ -185,12 +190,11 @@ visibility, release evidence contour and legal package. Они требуют д
 - PR review checklist exists in `docs/REVIEW_CHECKLIST_RU.md`.
 - Advisory branch protection policy exists in
   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
-- Branch protection evidence template exists in
-  `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` with
-  `pending_manual_verification` status.
+- Branch protection evidence exists in `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`
+  with `verified_active_ruleset` status.
 - PR-based workflow documentation exists in `docs/PR_REVIEW_WORKFLOW_RU.md`.
 - PR review evidence template exists in `docs/PR_REVIEW_EVIDENCE_RU.md`;
-  first reviewed PR evidence remains pending.
+  PR #50 required checks passed, but first reviewed PR evidence remains pending.
 - Public PR template includes security, registry-claim, runtime/API/UI,
   smoke-test, rollback and evidence checklist items.
 - Visible external code review remains pending until public reviewed PRs exist.