docs(review): add risk-based read-only agent gates

scripts/validate_harness_governance.py

@@ -611,14 +611,36 @@ def validate_gitea_artifacts(root: Path) -> list[Finding]:
         require_markers(
             root,
             ".gitea/ISSUE_TEMPLATE/task.md",
-            ("task_id:", "task_file:", "context_ref:", "write_paths:", "lease_until:"),
+            (
+                "task_id:",
+                "task_file:",
+                "context_ref:",
+                "write_paths:",
+                "lease_until:",
+                "review_mode:",
+                "writer:",
+                "test_reviewer:",
+                "risk_reviewer:",
+            ),
         )
     )
     findings.extend(
         require_markers(
             root,
             ".gitea/PULL_REQUEST_TEMPLATE.md",
-            ("Closes #", "task_file:", "context_ref:", "write_paths:", "验证证据"),
+            (
+                "Closes #",
+                "task_file:",
+                "context_ref:",
+                "candidate_sha:",
+                "write_paths:",
+                "验证证据",
+                "review_mode:",
+                "测试评审",
+                "安全/架构评审",
+                "reviewed_sha",
+                "verdict",
+            ),
         )
     )
     workflow = ".gitea/workflows/harness-governance.yml"