ci: adopt tiered contributor validation

WORKSPACE.md

@@ -40,24 +40,26 @@ OBLITERATUS is a Python research tool. The default pull-request baseline must be
 CPU-safe, deterministic, and must not download models or require network,
 accelerator, or remote-execution credentials.
 
-Canonical required checks:
+Canonical pull-request checks:
 
 - the exact Ruff F and actionlint command set in [.github/workflows/ci.yml](.github/workflows/ci.yml);
-- `python -m pytest` with at least 75% repository line coverage and 60% branch
-  coverage;
-- at least 95% changed-line coverage plus no line or branch regression in any
-  touched production module, compared with coverage from the exact base commit;
-- at least 80% line and 75% branch coverage for new production modules;
-- at least 94% line and 84% branch coverage for the documented mature
-  CPU-testable scope, plus an 85% selective mutation score and zero unexpected
-  warnings;
-- normalized per-test and per-marker duration evidence, owned slow-test
-  exceptions, fixed repeat-campaign budgets, and a ten-minute test-job cap;
-- `python -m build --sdist --wheel`
+- the versioned core suite plus tests selected from the exact diff through
+  [ci/test-risk-map.json](ci/test-risk-map.json) and
+  [ci/pr-test-policy.json](ci/pr-test-policy.json);
+- at least 50% changed executable-line coverage, with behavior changes required
+  to exercise relevant tests rather than relying on the smoke suite alone;
+- `python -m build --sdist --wheel` when package inputs change;
 - `python -c 'import obliteratus; print(obliteratus.__version__)'`
 - `python -m obliteratus --help`
 
-CI additionally validates wheel and sdist metadata, installs each distribution
+The exhaustive gate runs for `v*` tags and explicit manual release validation,
+not ordinary pull requests. It runs the full Python 3.10-3.12 suite with at least
+75% repository line coverage and 60% branch coverage; exact-base touched-module
+regression and 80%/75% new-module floors; 94%/84% mature CPU-scope coverage;
+selective mutation at 85%; repeat and duration budgets; Windows checkpoint
+contracts; packaging; and supply-chain certification.
+
+Release CI additionally validates wheel and sdist metadata, installs each distribution
 in an independent environment outside the checkout, exercises both CLI entry
 paths, and retains the distributions plus evidence. Immutable CI action/tool
 pins are recorded in [ci/digests.txt](ci/digests.txt).
@@ -82,8 +84,10 @@ of the default CPU job.
 
 Use [.aiwg/bt6-maintainer.yaml](.aiwg/bt6-maintainer.yaml) and the project-local
 `bt6-maintainer` bundle for issue, pull-request, provider, and merge-train work.
-Maintainers may add missing tests to already-reviewed legacy pull requests as a
-one-time transition courtesy. New changes must include relevant tests and keep
-the complete required suite green.
+Contributors should include focused tests and must not submit behavior changes with
+zero relevant coverage. A passing PR gate makes a submission reviewable, not
+automatically merge-ready. Maintainers own any additional tests, compatibility
+hardening, and full-suite validation needed before merge, and the tagged release
+gate remains the final certification boundary.
 
 <!-- AIWG:workspace-operator:end -->