docs(governance): add review process residual risks and issue plan

.github/CODEOWNERS

@@ -1 +1,34 @@
+# AWatch-rus CODEOWNERS
+#
+# Ownership is used for review routing and engineering accountability.
+# It does not certify security, legal readiness, performance or fitness for
+# production use. Contributors remain responsible for the safety of their
+# submissions.
+
+# Repository default owner.
 * @igor04091968
+
+# Rust workspace and crates.
+/adk-rust/ @igor04091968
+**/Cargo.toml @igor04091968
+**/Cargo.lock @igor04091968
+**/*.rs @igor04091968
+
+# Operational scripts and automation.
+/scripts/ @igor04091968
+
+# Registry-readiness evidence and policy documents.
+/docs/registry/ @igor04091968
+
+# GitHub public mirror validation metadata.
+/.github/workflows/ @igor04091968
+/.github/pull_request_template.md @igor04091968
+/.github/ISSUE_TEMPLATE/ @igor04091968
+
+# Ansible deployment automation.
+/ansible/ @igor04091968
+
+# Security and contribution governance.
+/SECURITY.md @igor04091968
+/CONTRIBUTING.md @igor04091968
+/deny.toml @igor04091968

.github/pull_request_template.md

@@ -2,11 +2,37 @@
 
 Describe what changed and why.
 
+## Impact
+
+- Runtime impact: `none / changed / not applicable`
+- API impact: `none / changed / not applicable`
+- UI impact: `none / changed / not applicable`
+- Documentation impact: `none / changed / not applicable`
+- Rollback impact: `none / documented / not applicable`
+- Evidence impact: `none / registry docs updated / release evidence required`
+
 ## Validation
 
 List commands executed. Use `skipped: <reason>` when a check requires a live
 stand or unavailable tool.
 
+## Review Checklist
+
+- [ ] I checked that this PR does not publish secrets, tokens, passwords,
+      private keys, recovery codes or live credentials.
+- [ ] I checked that this PR does not publish personal data, real employee data,
+      customer logs or customer infrastructure identifiers.
+- [ ] I checked registry claims: no completed registry submission, no
+      FSTEC/FSB certification claim, no SIEM/DLP replacement claim.
+- [ ] I ran relevant checks or documented why a check was skipped.
+- [ ] I stated runtime/API/UI impact.
+- [ ] I stated documentation impact.
+- [ ] I stated smoke-test result or why smoke testing is not applicable.
+- [ ] I stated rollback and evidence impact.
+- [ ] I checked that GitHub Actions remains public mirror validation only.
+- [ ] I checked that registry release evidence still requires the Russian
+      build-runner.
+
 ## Registry / Public Mirror Scope
 
 - GitHub is public mirror validation only.