docs(governance): prepare branch protection and PR review evidence

docs/PR_REVIEW_EVIDENCE_RU.md

@@ -0,0 +1,74 @@
+# AWatch-rus: PR review evidence
+
+Дата: 2026-06-23
+
+pr_review_evidence_status: "pending_until_first_reviewed_pr_is_merged"
+
+GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/48
+
+Этот документ фиксирует, что будет считаться evidence для PR-based review
+workflow. Он не утверждает, что external peer review уже выполнен.
+
+## Evidence Criteria
+
+Первый evidence-backed reviewed PR должен содержать:
+
+- PR URL;
+- linked issue URL;
+- completed pull request template;
+- passed checks;
+- reviewer approval;
+- merge commit;
+- no bypass, or documented bypass with reason and follow-up checks.
+
+## Evidence Record
+
+- PR URL: `pending`
+- Linked issue URL: `pending`
+- Reviewer: `pending`
+- Reviewer type: `pending`
+- Approval URL or screenshot filename: `pending`
+- Passed checks: `pending`
+- Merge commit: `pending`
+- Bypass used: `pending`
+- Date: `YYYY-MM-DD`
+- Maintainer note: `pending`
+
+## Reviewer Interpretation
+
+Review by the same maintainer improves change discipline but does not prove
+external peer review. External peer review must not be marked completed unless a
+reviewed public PR includes a reviewer who is not the submitting maintainer and
+the review is visible.
+
+## Current Status
+
+- PR workflow documentation: ready.
+- PR template: ready.
+- CODEOWNERS routing: ready.
+- First reviewed PR evidence: pending.
+- External peer review completed: not claimed.
+
+## Not Registry Release Evidence
+
+PR review evidence is governance/process evidence for public development
+visibility. It is not registry release evidence and does not replace artifacts,
+checksums, logs or release evidence from the Russian build-runner.
+
+## Russian Contour Note
+
+Primary registry-readiness contour remains Russian Gitea plus the planned
+Russian build-runner. GitHub remains public mirror validation only.
+
+## Guardrails
+
+- Do not publish secrets, private URLs, private account data or customer
+  identifiers.
+- Do not claim completed external peer review until the evidence record is
+  filled from a real reviewed PR.
+- Do not claim branch protection verification from PR evidence alone.
+- Do not claim completed registry submission.
+- Do not claim certification.
+- Do not claim SIEM/DLP replacement.
+- Do not claim ML/LLM-based detection.
+- Do not claim automatic remediation.