Automate ADR-backed component review guidance

[adierkens]

Closes #

Builds on #8173's small ADR-backed review trial by replacing its hand-authored instruction with a complete, validated policy generation system. Public ADRs and maintained contributor guidance produce path-scoped Copilot Code Review instructions; sanitized internal direction is limited to outcome-only rules.

Changelog

New

• Structured public and outcome-only internal policy manifests
• Deterministic path-scoped instruction generation
• Reusable component-review skill and read-only reviewer agent
• Schema, privacy, source-digest, and generated-output tests

Changed

• Replaces the base PR trial instruction with the generated policy catalog
• ADR authoring guidance identifies review-policy impact
• CI checks generated guidance and lint autofix regenerates stale output

Removed

• The hand-authored four-rule trial instruction from the base PR

Rollout strategy

• Patch release
• Minor release
• Major release; if selected, include a written rollout or migration plan
• None; review tooling, documentation, and CI only. No published package behavior changes.

Testing & Reviewing

Review this after the base trial establishes that path-scoped ADR rules produce useful CCR feedback. Compare contributor-docs/review-guidance/ with the generated instructions and consolidated skill reference. The internal policy intentionally excludes private provenance, identifiers, rationale, links, and alternatives.

Run npm run test:review-guidance and npm run check:review-guidance.

[github-actions]

⚠️ Action required

👋 Hi, this pull request contains changes to the source code that github/github-ui depends on. If you are GitHub staff, test these changes with github/github-ui using the integration workflow. If this doesn't work, you can also use the original workflow here. Check the integration testing docs for step-by-step instructions. Or, apply the integration-tests: skipped manually label to skip these checks.

To publish a canary release for integration testing, apply the Canary Release label to this PR.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e9ca907

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR