fix(ci): keep elapsed review deadlines out of ordinary merge gates

[ty-everett]

Problem and result

Elapsed documentation and dependency-exception review dates were stopping unrelated source changes and cascading into skipped build/test lanes. Ordinary CI now reports elapsed review dates as maintenance reminders; structural/date consistency, exception ownership/evidence, dependency audits, generated facts, tests, and analysis remain blocking.

A separate weekly/manual Maintenance review deadlines workflow enforces full documentation and exception deadlines without participating in the merge gate. This extends the intent of #531. The nanoid exception was reviewed and retained because installed PostCSS 8.5.23 still declares ^3.3.16, permitting versions below the fixed 3.3.18 boundary; its next review is October 15. No package or runtime behavior changes.

Verification

• Node 24.19.0 / pnpm 10.33.2 frozen installation with lifecycle scripts disabled.
• All 206 repository-control tests pass, including simulated future expiry, normal-versus-maintenance behavior, and malformed record/date rejection.
• pnpm health:check, pnpm lint, pnpm format:check, full pnpm build, and pnpm typecheck pass.
• pnpm audit:security passes with the two existing patched image-size advisory exclusions; no new exclusion.
• node scripts/repository-health.mjs --maintenance, dependency governance, and git diff --check pass.
• Exact head 562a86c: CI run35009522439, CodeQL run35009522175, conformance, Socket, and Sonar zero-new-findings all passed. Review threads: zero. Full local docs build also passed (127 rendered pages and built links).

Dependency evidence

• Release notes and necessity: No dependency or lockfile changed. Review-date handling and one existing exception review were updated.
• Runtime, build, and peer compatibility: No runtime/API/wire change.
• Deduplicated lockfile: Unchanged; frozen installation passed.
• Audit and CodeQL: Audit passed; hosted CodeQL passed.
• Package and consumer tests: Full build/typecheck and repository-control tests passed; hosted applicable matrix passed.
• Bundle and performance impact: No runtime bytes changed.
• Affected public package versions: None; repository-only policy and tooling.

Release and operations

No publication, image, deployment, or live workload change. The operator authorized this maintenance policy and admin merge after complete validation. Larger overlay work and existing QA trackers are outside this change.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud