ci(governance): R5b — version-string drift gate in reusable (#329)

## Summary

Adds R5b to the `security-policy` job in `governance-reusable.yml`,
right alongside R0 / R1 (where the existing tooling-version integrity
rules live).

Hard-blocks `Version: x.y.z` / `**Version**: x.y.z` / `_Version_=
v1.2.3` patterns in repo-root `*.md` + `*.adoc` files (excluding
`CHANGELOG.{md,adoc}`). Defers all version state to `CHANGELOG.md`
(release history), `Cargo.toml`'s `[package].version` (semver pin), and
the git log (dates).

## Why now

echidna shipped this exact rule locally last week as
`governance-doc-drift.yml` R5b
([echidna#171](hyperpolymath/echidna#171)). The
drift pattern that motivated it — `Version: 1.5.0` in `README.adoc`,
`**Version**: 2.3.0` in `CLAUDE.md`, `2.1.0` in `Cargo.toml`, all
simultaneously — generalises to every long-lived repo.

## Scope decision

R5b only (version strings). R5a (bare prover counts) stays repo-local in
echidna because the count semantics are domain-specific (prover backends
vs. stdlib functions vs. proof obligations vs. syntax features). A
future generic R5 with per-repo configurable canonical patterns is the
natural extension, but R5b stands alone today.

Sub-tree docs (`docs/handover/`, `docs/decisions/`, `docs/releases/`,
audit reports) deliberately out of scope — owner-managed snapshots, not
the canonical narrative surface.

## Baseline scan results

- **standards** (this repo): 0 hits ✓
- **proven**: 0 hits ✓
- **ephapax**: 0 hits ✓
- **affinescript**: 0 hits ✓
- **typed-wasm**: 0 hits ✓

Estate-wide rollout is safe — no caller repo will be retroactively
broken.

## Self-tested

- `python3 -c "import yaml; yaml.safe_load(...)"` → OK
- Negative test (synthetic):
  - `*Version*: 1.2.3` → fires ✓
  - `Version: v0.5.0` → fires ✓
  - `**Version**= 9.9.9` → fires ✓
- `This is v1.2.3 software.` → correctly does NOT fire (no `Version:`
prefix anchored)

## Downstream rollout

Caller repos consume by bumping their `governance.yml` wrapper SHA pin.
echidna can also drop its local R5b (keeping R5a) once it bumps the pin.
Cohort fan-out will follow this change.

## Test plan

- [x] YAML safe_load OK
- [x] Self-test on this repo's root docs → 0 hits
- [x] Negative test on synthetic drift → fires
- [x] Baseline-scan on 4 cohort repos → 0 hits each
- [ ] CI on this PR
- [ ] Downstream caller-repo SHA-pin bumps (echidna + cohort)

Refs hyperpolymath/echidna#171.

Author: hyperpolymath

.github/workflows/governance-reusable.yml

@@ -572,6 +572,49 @@ jobs:
           [ "$R1" -gt 0 ] && { echo "❌ [R1] $R1 unversioned family-tool install(s) — pin tool: <name>@<ver>"; exit 1; }
           echo "✅ Tooling version integrity passed (R1 clean; R4 advisory via standards/tasks/tooling-integrity-lint.sh)"
 
+      - name: Documentation version-string drift (R5b)
+        # Estate canonical-reference drift policy. Forbids pinned
+        # `Version: x.y.z` strings in load-bearing top-level docs
+        # because they reliably go stale and disagree with each other
+        # (echidna had v1.5.0 in README.adoc, v2.3.0 in CLAUDE.md,
+        # v2.1.0 in Cargo.toml simultaneously — cleared by echidna#169
+        # / #170 / #171). CHANGELOG.md is the canonical release-history
+        # surface; Cargo.toml's [package].version is the canonical
+        # semver pin; the git log carries dates. Duplicating either
+        # in human prose invites drift.
+        #
+        # Scope: repo-root *.md + *.adoc only. Sub-tree historical
+        # docs (docs/handover/, docs/decisions/, docs/releases/,
+        # audit reports) are owner-managed snapshots and not in
+        # scope. CHANGELOG.{md,adoc} explicitly skipped.
+        #
+        # Companion rule R5a (bare prover counts) is repo-local where
+        # the count semantics are domain-specific — see
+        # `echidna/.github/workflows/governance-doc-drift.yml`.
+        run: |
+          set -uo pipefail
+          PATTERN='^[[:space:]]*[*_]{0,2}Version[*_]{0,2}[[:space:]]*[:=][[:space:]]*v?[0-9]+\.[0-9]+\.[0-9]+'
+          R5B=0
+          shopt -s nullglob
+          for doc in *.md *.adoc; do
+            [ -f "$doc" ] || continue
+            case "$doc" in CHANGELOG.md|CHANGELOG.adoc) continue ;; esac
+            while IFS= read -r hit; do
+              [ -n "$hit" ] || continue
+              echo "❌ [R5b] pinned version string: $doc:$hit"
+              R5B=$((R5B+1))
+            done < <(grep -nE "$PATTERN" "$doc" 2>/dev/null || true)
+          done
+          if [ "$R5B" -gt 0 ]; then
+            echo ""
+            echo "❌ [R5b] $R5B pinned version-string line(s) in load-bearing docs."
+            echo "Fix: drop the embedded version; defer to CHANGELOG.md (release"
+            echo "history) and Cargo.toml's [package].version (semver pin) or the"
+            echo "equivalent package manifest. Git log carries dates."
+            exit 1
+          fi
+          echo "✅ [R5b] Documentation version-string drift: clean."
+
   quality:
     name: Code quality + docs
     runs-on: ${{ inputs.runs-on }}