)

Eighth PR in the 12-PR file-policy rollout. Three new subcommands that
together cover the high-risk half of file policy: which workflows are
authorized, what commands they may invoke, and what endpoints they may
contact.

## Commands

- `cargo xtask check-workflow-surfaces`
    Universe: tracked `.github/workflows/*.yml`. Each must have a
    `[[workflow]]` entry in `policy/workflow-allowlist.toml`. Each entry
    must name a `process_policy` and `network_policy` that exist in
    their respective ledgers. Entries with `kind = "dependabot_config"`
    are catalog-only and exempt from the workflow-file reconciliation;
    their receipts are still validated (missing fields, expired, stale).

- `cargo xtask check-process-policy`
    For each receipted workflow (excluding `kind = "dependabot_config"`),
    scan its file content for known shell-command tokens; flag tokens
    not present in the workflow's declared `process` profile's
    `allowed_processes`.

- `cargo xtask check-network-policy`
    For each receipted workflow, regex-scan for `https?://<host>` URLs
    and reconcile hostnames against the declared `network` profile's
    `allowed_endpoints`. Subdomain coverage is recognized (e.g.,
    `raw.githubusercontent.com` covers `objects.githubusercontent.com`).

All three accept `--mode advisory|blocking-allowlist|blocking-strict`.

## Decisions

- **Grep heuristics, not YAML/AST parsing.** The PR spec explicitly
  said "start simple". The recognition vocabulary for `check-process-
  policy` is a fixed list of well-known shell commands; tokens outside
  that list are silently ignored. This produces false positives where
  a command name appears as a build target or argument (e.g., the word
  "shipper" in `cargo build -p shipper`). Advisory mode reports these;
  CI does not block on them. Refining the detector (e.g., requiring
  the token to appear inside a `run:` block) is a follow-up.

- **`dependabot_config` skip** in workflow-surfaces / process / network
  checks. The `.github/dependabot.yml` entry rides along in the
  workflow allowlist for catalog purposes (see #215 PR body), but it
  is not a workflow file and has no shell commands or URLs to scan.

- **Subdomain endpoint matching.** `allowed_endpoints = ["github.com"]`
  covers `api.github.com`, `objects.githubusercontent.com`, etc.,
  rather than requiring every host be enumerated. Tighter modes
  remain available via the explicit-only `allowed_endpoints`.

- **New direct dep: `regex = "1"`.** Used only by `check-network-policy`
  for the host extraction pattern. Could be replaced by hand-rolled
  parsing if dep weight becomes an issue.

## Acceptance

- `cargo check --workspace --locked` passes.
- `cargo clippy -p xtask --all-targets --locked -- -D warnings` clean.
- `cargo fmt --all -- --check` clean.
- Live results on current main:
    check-workflow-surfaces: workflows=9 entries=10 unreceipted=0 missing=0 expired=0 stale=0 unused=0 invalid_refs=0
    check-process-policy:    workflows=9 unknown_total=10  (all false positives — see PR body)
    check-network-policy:    workflows=9 unknown_total=0

## Out of scope

- Unified policy-report (PR 9 / #208)
- CI advisory wiring (PR 10 / #209)
- Promotion to blocking-allowlist (PR 11 / #210, PR 12 / #211)
- Refining the process-detector to suppress build-target false positives.
- DRY-up of the shared `workspace_root`, `today_iso`, `date_is_past`,
  `tracked_workflow_files` helpers across xtask modules.

Closes #207.