Adopt proof-pr v0.2.2 introduced metadata checks

[saagpatel]

Summary

• updates the reusable workflow and installed CLI pin to v0.2.2
• enables check_public_git_metadata
• uses public_git_metadata_mode: introduced so legacy public history does not block new-commit hygiene

Proof Bundle

Risk: T3
Receipt: proof-pr.v1 for 9cadf0f711957dbdae319c3d39bb9802fb5bd2e0
Decision: ready_with_operator_awareness

Evidence:

• release-available: v0.2.2 release exists with validated receipt asset -> passed.
• workflow-update: reusable workflow and install ref both pin v0.2.2 -> passed.
• introduced-metadata-gate: check_public_git_metadata: true and public_git_metadata_mode: introduced -> passed.
• github-workflow-dispatch: passed (manual workflow passed on PR Adopt proof-pr v0.2.2 introduced metadata checks #98 after rebase, including active introduced metadata check.)
• rollback: documented (revert this PR or pin back to v0.2.1.)

Known gaps:

• Full-history metadata cleanup remains deferred; this PR gates newly introduced commits only.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2539692dc1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Re-author commit before enabling the metadata gate

With check_public_git_metadata enabled in introduced mode, the v0.2.2 reusable workflow runs proof-pr check-public-git-metadata --base-ref "$base_ref" --ref "$PUBLIC_METADATA_REF", and that CLI's default allow-list only accepts GitHub noreply addresses. The reviewed commit introduced by this PR is authored and committed as Codex <codex@openai.com> (git log 1952f25..1804883 --format=...), so dispatching this proof workflow on this PR branch will fail before receipt validation; re-author this commit with a GitHub noreply address or the new gate cannot pass for the change that enables it.

Useful? React with 👍 / 👎.