docs(security): add github target collection checks

docs/security/github-target-owner-decision-response.snapshot.json

@@ -24,6 +24,7 @@
     "owner_response_template_status_count": 7,
     "owner_response_audit_event_template_count": 3,
     "owner_response_redaction_example_count": 5,
+    "owner_response_collection_check_count": 6,
     "response_template_count": 7,
     "received_response_count": 0,
     "accepted_response_count": 0,
@@ -569,6 +570,74 @@
       "not_approval": true
     }
   ],
+  "owner_response_collection_checks": [
+    {
+      "check_id": "collection-github-target-request-packet-displayed",
+      "display_order": 1,
+      "title": "已顯示 GitHub target owner response request packet",
+      "required": true,
+      "pass_condition": "AwoooP 必須只顯示 `owner_response_request_packet` 的 7 個 target templates、允許欄位、脫敏 evidence 規則與禁止 payload，不得附加 repo creation、visibility change、refs sync 或 primary switch 要求。",
+      "failure_lane": "keep_waiting_owner_response",
+      "awooop_display": "display_request_packet_only",
+      "execution_authorized": false,
+      "not_approval": true
+    },
+    {
+      "check_id": "collection-github-target-read-only-submission-mode",
+      "display_order": 2,
+      "title": "GitHub target 收件模式維持 read-only",
+      "required": true,
+      "pass_condition": "owner 只能用 read-only markdown response、redacted metadata pointer、request_more_evidence 或 out_of_scope_disposition；不得提交 token、repo archive、git object pack、API write request 或 execution request。",
+      "failure_lane": "quarantine_sensitive_payload",
+      "awooop_display": "display_read_only_submission_only",
+      "execution_authorized": false,
+      "not_approval": true
+    },
+    {
+      "check_id": "collection-seven-target-template-tracking",
+      "display_order": 3,
+      "title": "七個 GitHub targets 分開追蹤",
+      "required": true,
+      "pass_condition": "S4.10 七個 requested_template_ids 必須逐 target 追蹤 received / accepted / rejected 狀態；不可用單一整體同意取代逐 repo owner / visibility / canonical response。",
+      "failure_lane": "request_more_evidence",
+      "awooop_display": "display_per_target_tracking",
+      "execution_authorized": false,
+      "not_approval": true
+    },
+    {
+      "check_id": "collection-github-target-redacted-evidence-only",
+      "display_order": 4,
+      "title": "只收 GitHub target 脫敏 evidence refs",
+      "required": true,
+      "pass_condition": "收件內容只能包含 repo 內路徑、snapshot path 或已脫敏 metadata pointer；任何不確定是否含 token、private URL credential、secret、repo archive 或 git object 的資料都先進 quarantine。",
+      "failure_lane": "quarantine_sensitive_payload",
+      "awooop_display": "display_redacted_evidence_only",
+      "execution_authorized": false,
+      "not_approval": true
+    },
+    {
+      "check_id": "collection-github-target-no-approval-language",
+      "display_order": 5,
+      "title": "不得把 GitHub target 回覆語意升級成批准",
+      "required": true,
+      "pass_condition": "即使 owner response 文字包含同意、OK、可進行或批准，也只能視為 owner / visibility / canonical disposition response；不得視為 repo creation、visibility change、refs sync、delete refs、force push 或 GitHub primary approval。",
+      "failure_lane": "reject_execution_request",
+      "awooop_display": "display_scope_response_only",
+      "execution_authorized": false,
+      "not_approval": true
+    },
+    {
+      "check_id": "collection-github-target-audit-metadata-only",
+      "display_order": 6,
+      "title": "只記錄 GitHub target audit metadata",
+      "required": true,
+      "pass_condition": "AwoooP 只能記錄 request shown、response received metadata、template id、github repo、owner role/team、redacted evidence refs 與 outcome lane；不得保存 token value、secret value、private clone URL credential、repo archive、git object pack 或可執行 payload。",
+      "failure_lane": "quarantine_sensitive_payload",
+      "awooop_display": "display_audit_metadata_only",
+      "execution_authorized": false,
+      "not_approval": true
+    }
+  ],
   "response_templates": [
     {
       "template_id": "target-awoooi-refs-blocked",