fix(governance): retire legacy guards and external actions

apps/api/src/services/awoooi_priority_work_order_readback.py

@@ -513,6 +513,25 @@ _AI_AUTOMATION_PROGRAM_WORK_ITEMS: list[dict[str, Any]] = [
         ],
         "next_action": "把 IWOOOS/Wazuh/SIEM control coverage 接入 canonical AutomationRun 與 controlled response registry。",
     },
+    {
+        "id": "AIA-P0-009",
+        "priority": "P0",
+        "order": 9,
+        "status": "in_progress",
+        "title": "移除所有 Gitea workflow 對 GitHub action supply chain 的依賴",
+        "problem": "Gitea runner 仍會把 actions/checkout 等 action 從 github.com 抓入執行環境，GitHub freeze 尚未覆蓋 CI action resolution。",
+        "professional_practice": "self-hosted action registry、immutable digest pinning、SBOM/provenance、network egress verification",
+        "asset_scope_ids": ["products", "tools", "packages", "observability_and_security"],
+        "observed_awoooi_gitea_workflow_file_count": 13,
+        "observed_awoooi_external_action_reference_count": 16,
+        "acceptance": [
+            "所有產品的 Gitea workflow action 只由受控 Gitea mirror 或 repo-owned immutable action 供應",
+            "runner egress verifier 證明 workflow 執行期間對 github.com 與 api.github.com 的連線為零",
+            "每個 action 具有 digest、SBOM、provenance、更新與 rollback 證據",
+            "既有 .github/workflows 全部標記 retired/do_not_use，不再作為 CI/CD truth",
+        ],
+        "next_action": "建立跨產品 action inventory，先遷移 checkout/setup 類共用 action到受控 Gitea action registry。",
+    },
     {
         "id": "AIA-P1-001",
         "priority": "P1",