Fix Governor idempotency and #350 human-gating

[Svaag]

Summary

• make reliability governor idempotency compare stable decision content instead of run-specific record ids
• ignore volatile record fields and Knowledge export identifiers when checking prior audit records
• classify network-operations DNS64/resolver VM infrastructure as production network work even when the issue also asks for docs/tests
• human-gate sensitive production network domains before generic missing-rollback/context checks

Checks

• uv run ruff check src/hyrule_engineering_loop/governor.py tests/test_phase29_governor.py
• uv run pytest tests/test_phase29_governor.py
• uv run pytest

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7d0d333dab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Use only the latest prior decision for idempotency

When an issue has an earlier approved record, is later edited to a different decision, and then is reverted while the Knowledge pack id/export has rotated, this scan can return the old matching JSON file even though a newer conflicting Reliability Decision Record comment exists. governor_once then skips reposting or just reapplies labels, but the daemon consumes the latest trusted Decision Record comment, so the issue can be labeled loop:approved while the daemon still sees the later needs_human/stale record and refuses to run it. Treat a match as idempotent only if it is the newest decision for that issue, or post a fresh record when newer conflicting records exist.

Useful? React with 👍 / 👎.