Authoring-assist: promote to first-class tool with non-blocking PR advisory

Promotes the authoring-assist prototype to a first-class BCQuality feature that
reviews knowledge-article front-matter and proposes missing routing `signals:`
(raise triggers and `effect: suppress` suppressors). The suggestion is ADVISORY
ONLY: it never fails a build; authors apply it via a normal PR under existing
R29 + CI + CODEOWNERS review.

Feature:
- tools/Suggest-ArticleSignals.ps1: suggestion engine hardened with a stable JSON
  contract (schemaVersion/toolVersion) and a deterministic, effect-sensitive
  per-proposal suggestionId, plus -ChangedFiles scoping for PR-diff runs. Runs
  self-contained: the routing seed is now OPTIONAL (built-in domain map), so this
  does not depend on the separate routing-index tuning thread.
- tools/New-AuthoringAssistComment.ps1: renders one upsertable, feedback-instrumented
  advisory comment (stable anchor + aa:meta/aa:article markers carrying suggestionIds
  + reaction footer) for the downstream acceptance-measurement work.
- .github/workflows/authoring-assist*.yml: unprivileged pull_request intake +
  trusted workflow_run runner (review/publish split) + in-repo self-test.
- tools/Test-SuggestArticleSignals.ps1: 23-check smoke test (contract, determinism,
  scoping, suppressor/prohibition, renderer markers, seed-free graceful degradation).

Dormant schema support:
- .github/scripts/validate_frontmatter.py: adds R29, validating the optional
  `signals` block shape (bare token or mapping with token + optional
  pattern/domain/effect in {raise,suppress}). Reserved & dormant — no production
  pipeline consumes it; the existing PR Reviewer only reads `effect: suppress`
  behind its BCQ_INDEX_V2 flag and falls back safely when absent. Existing rules
  (incl. R24 skill-id uniqueness, R27, R28) are unchanged.

Excludes the routing-index tuning thread entirely (separate work).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 75d852d6-18a6-4c58-986f-ed5ab16618fa

.github/workflows/authoring-assist.yml

@@ -0,0 +1,50 @@
+name: Authoring-assist advisory
+
+# Unprivileged intake. Fires on PRs that add/modify knowledge articles and
+# captures PR metadata as an artifact. All privileged work (reading the PR head,
+# generating suggestions, posting the advisory comment) happens in the companion
+# `Authoring-assist advisory runner` workflow, which runs in the trusted
+# `workflow_run` context. This split lets the advisory comment on fork PRs
+# without ever exposing a write-scoped token to a job that reads untrusted PR
+# content. The advisory is NON-BLOCKING: it only suggests, never fails a check.
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, reopened, synchronize, ready_for_review]
+    paths:
+      - '**/knowledge/**/*.md'
+
+concurrency:
+  group: authoring-assist-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  intake:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: pwsh
+    steps:
+      - name: Save PR metadata
+        run: |
+          $outputDir = Join-Path $env:GITHUB_WORKSPACE 'advisory-input'
+          New-Item -Path $outputDir -ItemType Directory -Force | Out-Null
+
+          @{
+            prNumber   = "${{ github.event.pull_request.number }}"
+            headSha    = "${{ github.event.pull_request.head.sha }}"
+            baseRef    = "${{ github.event.pull_request.base.ref }}"
+            repository = "${{ github.repository }}"
+          } | ConvertTo-Json -Depth 5 | Set-Content -Path (Join-Path $outputDir 'pr-metadata.json') -Encoding UTF8
+
+      - name: Upload advisory input
+        uses: actions/upload-artifact@v4
+        with:
+          name: authoring-assist-input-${{ github.event.pull_request.number }}
+          path: ${{ github.workspace }}/advisory-input
+          if-no-files-found: error