[mlaccetti]

Summary

Replace the generated policy's universal Mergify queue instruction with explicit personal and organization delivery flows.

• Personal repositories: wait for GitHub Actions, required checks and required reviews, then use a normal protected GitHub merge pinned to the reviewed head with --match-head-commit. No queue is required; its absence is expected.
• rckt-corp: use native GitHub enqueuePullRequest with expectedHeadOid matching the reviewed PR head and explicit dequeuePullRequest. Preserve rckt-corp/apple-signing's signing-specific workflow and queue exemption. If a required queue is unavailable or rejects entry, report the blocker rather than substituting a direct merge.
• Other organizations: follow the repository's configured delivery flow.

Every flow preserves branch protections and required reviews, rejects forged check/status results, refreshes validation after a changed head, and verifies the actual merge and post-merge CI on its exact commit. Update the shared policy, README, architecture documentation and embedded-policy regression test together.

Validation

• Full go test ./... -race -count=1 passes.
• golangci-lint run ./...: zero issues.
• gofumpt -l kit/embed_test.go, scripts/check-no-sleep.sh and git diff --check pass.
• No installed kit or harness/global instructions changed; no personal-repository merge or release performed.

Before this update, CI was green but GitHub still reported REVIEW_REQUIRED for this PR. Existing required review remains a merge prerequisite and is not bypassed.

After the final concrete head is reviewed and installation is approved, use the updated binary or source to install the kit and relink the intended harness. Running the currently installed older binary would reinstall its embedded older policy.