ci: enforce shared repository hygiene and data provenance (#600)

Enforce shared PR-range repository hygiene in
[SIMPLE](https://github.com/itpplasma/SIMPLE), replacing the staged-only
aggregate checker with the public revision-pinned [shared
workflow](lazy-fortran/.github#2).

The gate checks secrets, 1 MiB/file, data/archive types and 5 MiB
aggregate additions, including intermediate commits. Exceptions require
tracked path globs and reasons; the 24-file rule and environment
override are removed. CONTRIBUTING documents synthetic/published fixture
provenance, external result archives, offline global hooks, SQUASH
integration and private-repo cluster validation.

[V] Six real-Git/Gitleaks tests and hosted shared-workflow CI passed.
Local global-hook checks exercise scratch repos and linked worktrees.
Numerical code and test inputs are unchanged; existing native CI remains
required.

Chris&AI

Author: krystophny

.github/workflows/repo-hygiene.yml

@@ -0,0 +1,11 @@
+name: Repository hygiene
+on:
+  pull_request:
+  merge_group:
+permissions:
+  contents: read
+jobs:
+  repo-hygiene:
+    uses: lazy-fortran/.github/.github/workflows/repo-hygiene.yml@4a515a95feac1fa1e79d2f721a4b20eb124b20f4
+    with:
+      hygiene-revision: 4a515a95feac1fa1e79d2f721a4b20eb124b20f4

CONTRIBUTING.md

@@ -60,6 +60,13 @@ invariants a change must keep.
    that are ready for review.
 5. Answer review with new commits. A maintainer merges.
 
+Before marking a PR ready, compare the final diff with the issue and PR
+contract. Remove unrelated work, redundant tests/docs, transient generated data
+and accidental large result sets. Squash fixups or reorganize commits into a few
+meaningful steps; preserve rejected scientific approaches only when their
+history is useful evidence. Do not rewrite shared, stacked or queued branches
+without coordinating with their users.
+
 Each pull request carries one risk tier, set by its highest-risk part. The
 tier sets the depth of review and the evidence required:
 
@@ -99,6 +106,28 @@ reference output without that explanation.
 - A branch need not be up to date with `main`. Merge `main` into a PR only
   when it conflicts.
 
+The merge queue uses `SQUASH`. Standalone PRs land as one commit; stacks
+land one squashed commit per layer. Record the lower layer's old head before
+merging; rebase the upper layer with
+`git rebase --onto origin/main <old-lower-head>` and retarget it to main.
+Recheck its final diff and affected tests after rebasing.
+
+The required repository-hygiene workflow scans the PR commit range for secrets,
+files over 1 MiB, data/archive types and aggregate additions over 5 MiB. The
+[pinned shared checker](https://github.com/lazy-fortran/.github/blob/main/REPO_HYGIENE.md)
+also runs offline on staged changes through the prompts global hook, before
+this repository's pre-commit hooks. Install `pre-commit` and its existing quick
+mechanical checks before committing. Reuse valid test evidence; builds,
+numerical tests and optional AI review do not belong in ordinary commit hooks.
+
+Artifact exceptions require a tracked `.repo-hygiene-allow`: repository-relative
+path glob, TAB, one-line provenance/reason. There is no environment override.
+Never commit non-public machine, experiment or collaborator data as fixtures
+(ITER/TC24/IMAS, AUG shots, JT-60SA inputs included). Use synthetic or published
+data with provenance. Keep campaign results externally with checksums.
+Heavy CI runs only in public repositories. Private repositories validate via
+cluster jobs, with job IDs, revision, commands and results recorded in the PR.
+
 ## Commit messages
 
 Use a lower-case type prefix and an imperative summary of at most about 72