Git is the authority. This origin serves the signed policy read-only:
every document here is mirrored byte-for-byte from the
hara-lang/hara-identity
repository, and clients pin an exact commit before accepting publisher
intents or registry attestations.