fix(governance): retire legacy guards and external actions

GLOBAL_RULES.md

@@ -85,7 +85,7 @@ IWOOOS/Wazuh/SIEM 不得只顯示工具安裝或 UI 可見；必須證明 signal
 
 ## 8. Secure Software Delivery
 
-- Gitea/Gitea SSH 是唯一 source-control authority；GitHub freeze 維持。
+- Gitea/Gitea SSH 是唯一 source-control authority；GitHub freeze 包含 Gitea workflow 的 action resolution，禁止從 `github.com` / `api.github.com` 下載 `actions/*`。
 - 每次 release 必須有 source SHA、focused tests、build/typecheck/i18n、Gitea CD run、deploy marker、production API/readback、desktop/mobile smoke。
 - dependency/image/model 更新需 SBOM、provenance、相容性 replay、security evaluation、shadow/canary、rollback。
 - 禁止 force push、未驗證 destructive migration、secret 明文或 mock/fake production evidence。

apps/api/src/services/awoooi_priority_work_order_readback.py

@@ -513,6 +513,25 @@ _AI_AUTOMATION_PROGRAM_WORK_ITEMS: list[dict[str, Any]] = [
         ],
         "next_action": "把 IWOOOS/Wazuh/SIEM control coverage 接入 canonical AutomationRun 與 controlled response registry。",
     },
+    {
+        "id": "AIA-P0-009",
+        "priority": "P0",
+        "order": 9,
+        "status": "in_progress",
+        "title": "移除所有 Gitea workflow 對 GitHub action supply chain 的依賴",
+        "problem": "Gitea runner 仍會把 actions/checkout 等 action 從 github.com 抓入執行環境，GitHub freeze 尚未覆蓋 CI action resolution。",
+        "professional_practice": "self-hosted action registry、immutable digest pinning、SBOM/provenance、network egress verification",
+        "asset_scope_ids": ["products", "tools", "packages", "observability_and_security"],
+        "observed_awoooi_gitea_workflow_file_count": 13,
+        "observed_awoooi_external_action_reference_count": 16,
+        "acceptance": [
+            "所有產品的 Gitea workflow action 只由受控 Gitea mirror 或 repo-owned immutable action 供應",
+            "runner egress verifier 證明 workflow 執行期間對 github.com 與 api.github.com 的連線為零",
+            "每個 action 具有 digest、SBOM、provenance、更新與 rollback 證據",
+            "既有 .github/workflows 全部標記 retired/do_not_use，不再作為 CI/CD truth",
+        ],
+        "next_action": "建立跨產品 action inventory，先遷移 checkout/setup 類共用 action到受控 Gitea action registry。",
+    },
     {
         "id": "AIA-P1-001",
         "priority": "P1",