docs: align contributor standards with BT6 gates

.github/pull_request_template.md

@@ -1,22 +1,63 @@
 ## Summary
 
-- TBD
+- Problem:
+- Change:
+- User-visible effect:
+- Linked issue: Closes #
 
-## Tests
+## Risk and trust assessment
 
-- [ ] `python -m ruff check --select F app.py obliteratus tests scripts`
-- [ ] `python -m ruff check --select E501 --statistics obliteratus tests scripts/gemma4_12b_recursive_loop.py` reviewed as known non-blocking line-length debt
-- [ ] `python -c 'import obliteratus; print(getattr(obliteratus, "__version__", "import ok"))'`
-- [ ] `python -m obliteratus --help`
-- [ ] `python -m pytest`
-- [ ] `python -m build --sdist --wheel`
+- Risk surfaces touched:
+- Untrusted inputs or external dependencies:
+- Remote code, deserialization, credentials, subprocess, network, or filesystem impact:
+- Compatibility or migration impact:
+
+## Test evidence
+
+Exact head SHA: `TBD`
+
+| Check | Result | Evidence or notes |
+|---|---|---|
+| Focused regression/contract tests | TBD | |
+| Negative and boundary tests | TBD | |
+| `python -m ruff check --select F app.py obliteratus tests scripts` | TBD | |
+| `uv lock --check` | TBD | |
+| `python -m pytest` | TBD | |
+| `python -m build --sdist --wheel` | TBD | |
+| Import and CLI smoke checks | TBD | |
+| Applicable risk-surface checks | TBD | |
+| Conditional hardware/service gates | not applicable / TBD | |
+
+Coverage or mutation impact:
+
+- Repository line/branch:
+- Changed-line:
+- Touched-module regression:
+- Mature CPU scope:
+- Mutation score, when applicable:
+
+## Research or performance evidence
+
+- Exact model/dataset revisions, configuration, seed, environment, and hardware:
+- Raw evidence/artifacts and hashes:
+- Baseline, uncertainty, limitations, and independent reproduction status:
+
+Use `Not applicable` when this pull request makes no research or performance claim.
 
 ## Checklist
 
-- [ ] Relevant tests were added or updated for new behavior.
-- [ ] The full test suite passes locally or the CI result is linked.
-- [ ] Documentation or examples were updated when user-facing behavior changed.
-- [ ] No secrets, credentials, generated provider files, or unrelated changes are included.
-- [ ] Any CI action or standalone-tool pin change also updates `ci/digests.txt`.
+- [ ] I added or updated tests for every changed behavior.
+- [ ] I covered relevant failure, boundary, and malformed-input paths.
+- [ ] The default test path remains deterministic, offline, credential-free, and CPU-safe.
+- [ ] I updated `ci/test-risk-map.json` or conditional policy when ownership changed.
+- [ ] Documentation and examples match user-visible behavior.
+- [ ] No secrets, private keys, credentials, caches, generated provider files, or unrelated changes are included.
+- [ ] Remote code and executable deserialization remain disabled by default, or the explicit exception is justified and tested.
+- [ ] Dependency, action, or tool changes include the reviewed lock/digest and supply-chain impact.
+- [ ] Research and performance claims are traceable to exact-head evidence and scoped to what was tested.
+- [ ] Every commit has a verifiable signature from its actual author or approved integration identity.
+- [ ] The branch has not been force-pushed and the exact head is ready for review.
 
-Legacy cleanup PRs may receive missing tests as a one-time maintainer courtesy when the change is already otherwise clean. New changes are expected to include relevant tests and keep the full suite passing.
+New changes are expected to include their complete relevant test suite. The one-time
+maintainer courtesy for already-reviewed legacy pull requests does not apply to new
+submissions.