chore(public): add CI coverage security and OSS process visibility

.github/pull_request_template.md

@@ -1,13 +1,24 @@
 ## Summary
 
-- what changed
-- why it changed
-- risk and rollback notes
+Describe what changed and why.
 
-## Checklist
+## Validation
 
-- [ ] No real secrets or credentials committed
-- [ ] Server-side scripts validated (`bash -n`)
-- [ ] PowerShell scripts validated (`Invoke-ScriptAnalyzer`)
-- [ ] Docs updated (full paths and runbook steps)
-- [ ] Rollback steps documented
+List commands executed. Use `skipped: <reason>` when a check requires a live
+stand or unavailable tool.
+
+## Registry / Public Mirror Scope
+
+- GitHub is public mirror validation only.
+- Primary registry release evidence must be produced on the Russian
+  build-runner.
+- Update `docs/registry/` when registry-readiness behavior or evidence changes.
+
+## Safety
+
+- No secrets, tokens, passwords or private keys.
+- No personal data.
+- No real employee logs.
+- No customer evidence unless anonymized.
+- No unsupported claims about certification, DLP/SIEM replacement or legal
+  registry completion.