docs(governance): prepare branch protection and PR review evidence

docs/RESIDUAL_RISKS_RU.md

@@ -50,21 +50,26 @@ visibility, release evidence contour and legal package. Они требуют д
 
 ## 2. Нет внешнего visible peer review / публично видимого peer review
 
-- Текущий статус: риск открыт; PR template and issue templates exist, but
-  public peer review history is still limited and external review is pending.
+- Текущий статус: риск открыт; PR template, CODEOWNERS, public governance
+  issues and PR workflow docs exist, but first reviewed PR evidence and branch
+  protection verification are still pending.
 - Влияние: внешним аудиторам сложнее оценить review discipline and change
   control maturity.
 - Почему не блокирует pilot/readiness stage: current changes are protected by
   reproducible checks, public workflows and documented conservative positioning.
-- Как риск будет снижаться: review checklist, CODEOWNERS routing, first public
-  PR reviews, explicit release branch review policy and advisory branch
-  protection.
+- Как риск будет снижаться: review checklist, CODEOWNERS routing, public issue
+  #48, `docs/PR_REVIEW_WORKFLOW_RU.md`, first public reviewed PR evidence,
+  explicit release branch review policy and verified branch protection evidence.
 - Уже снижающие evidence/documents/CI: `.github/pull_request_template.md`,
   `.github/CODEOWNERS`, `.github/ISSUE_TEMPLATE/`,
   `docs/REVIEW_CHECKLIST_RU.md`, `docs/BRANCH_PROTECTION_POLICY_RU.md`,
+  `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`,
+  `docs/PR_REVIEW_WORKFLOW_RU.md`, `docs/PR_REVIEW_EVIDENCE_RU.md`,
   `CONTRIBUTING.md`, `SECURITY.md`, public CI, public security workflow.
-- Следующий action: завести публичную задачу
-  `[governance] Enable PR-based review workflow`.
+- Residual risk: remains open until branch protection is verified and first
+  reviewed PR evidence exists.
+- Следующий action: выполнить maintainer verification for branch protection and
+  record first reviewed PR evidence without overstating external peer review.
 
 ## 3. Низкая публичная активность issue tracker
 
@@ -180,6 +185,12 @@ visibility, release evidence contour and legal package. Они требуют д
 - PR review checklist exists in `docs/REVIEW_CHECKLIST_RU.md`.
 - Advisory branch protection policy exists in
   `docs/BRANCH_PROTECTION_POLICY_RU.md`.
+- Branch protection evidence template exists in
+  `docs/BRANCH_PROTECTION_EVIDENCE_RU.md` with
+  `pending_manual_verification` status.
+- PR-based workflow documentation exists in `docs/PR_REVIEW_WORKFLOW_RU.md`.
+- PR review evidence template exists in `docs/PR_REVIEW_EVIDENCE_RU.md`;
+  first reviewed PR evidence remains pending.
 - Public PR template includes security, registry-claim, runtime/API/UI,
   smoke-test, rollback and evidence checklist items.
 - Visible external code review remains pending until public reviewed PRs exist.