CR-DD-012: Define shared governed run decision architecture

[coreytshaffer]

Status

Documentation only. No implementation authority.

CR-DD-012 approves the shared-decision architecture only. CR-DD-012A and
CR-DD-012B each require separate human implementation approval and their own
bounded file allowlist.

What changed

• Defines an immutable, exact-byte GovernedRunInputSnapshot shared by
  normalization, decision construction, preview, and execution.
• Defines the canonical, domain-separated GovernedDecision identity and
  separates governed policy from volatile runtime conditions.
• Preserves semantic ordering for source and fallback arrays; only explicitly
  set-like fields may be deterministically sorted.
• Decomposes future work into CR-DD-012A (foundation) and CR-DD-012B (shared
  consumption and envelope enforcement).
• Aligns the daily-driver architecture spec, backlog sequencing, and merged
  CR-DD-010/011 statuses.

Explicit non-changes

• docs/change/change_log.md is intentionally untouched.
• No code or tests changed.
• No runtime, ledger, artifact-contract, or CLI behavior changed.
• governed_run_plan.v1 remains unchanged, confirmable, inspectable, and
  non-executable.
• No governed_run_plan.v2, durable runtime-observation/execution-record
  schema, saved-plan execution, --confirmed-plan, cloud authority, resume
  semantics, acceptance, or quality scoring is added.

Review gate

• Confirm the changed-file allowlist matches the proposal.
• Confirm CR-DD-010/011 statuses accurately reflect PR CR-DD-010/011: Add governed run planning and exact confirmation linkage #104.
• Confirm architecture and backlog sequencing agree.
• Confirm no language authorizes CR-DD-012A or CR-DD-012B implementation.
• Confirm governed_run_plan.v1 remains unchanged.
• Confirm known untracked .fuse_hidden* and scratch files remain excluded.

Validation

• origin/main is an ancestor of the branch head.
• Complete branch diff: 5 documentation files, +823/-21.
• git diff --check origin/main...HEAD passed.
• Independent scope/contract review returned APPROVED.
• A full runtime suite was intentionally not run because this PR changes
  documentation only.

Sequencing after merge

Return to current main and create CR-DD-012A on a new proposal-only branch.
Do not implement CR-DD-012A directly from this branch.