[policy] feat(maintainers): add risk-based PR evidence gate

[heimanba]

Summary

• Add a lightweight evidence check for changes to provider contracts, configuration/schema parsing, release/package files, dependencies, and GitHub workflows.
• Keep ordinary documentation, examples, and small isolated changes free of this extra merge barrier.
• Add a maintainer review guide and make the check part of the existing Gate.

Why

AI-assisted contributions can produce a large, plausible diff quickly. This gives maintainers a concise statement of the behavior and validation evidence before reviewing high-blast-radius changes, without requiring AI disclosure, a design document, or an Issue for routine contributions.

Behavior / risk

High-risk PRs without a non-empty ## Behavior / risk and ## Validation section now fail the aggregate Gate. Low-risk paths continue to pass without those sections. The evidence check itself is included in the existing policy-surface protection.

Validation

• bun run verify:push
• bun test scripts/pr-evidence.test.ts
• bun test --timeout 20000 scripts/open-source.test.ts
• bun run typecheck:scripts
• Parsed .github/workflows/ci.yml with Ruby YAML and ran git diff --check.