docs: mark ai governance api spec as vendored for agents and review bot

Note in AGENTS.md and the PR review workflow that
content/reference/api/ai-governance/api.yaml is a verbatim copy of the
upstream OpenAPI spec, vendored from the private docker/governor-services
repo via hack/sync-governance-api.sh, and should not be hand-edited.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>

.github/workflows/pr-review.yml

@@ -42,6 +42,7 @@ jobs:
         - Any YAML file in `data/*/*.yaml` subdirectories (CLI reference data generated from upstream)
           - Examples: `data/engine-cli/*.yaml`, `data/buildx/*.yaml`, `data/scout-cli/*.yaml`
           - Exception: root-level data/ files are manually maintained (allow edits)
+        - `content/reference/api/ai-governance/api.yaml` (verbatim copy of the upstream OpenAPI spec, vendored from the private docker/governor-services repo via `hack/sync-governance-api.sh`)
 
         ### 2. Missing Redirects When Removing/Moving Pages (HIGH)
         When a PR removes or moves a page:

AGENTS.md

@@ -45,10 +45,16 @@ must go to the source repository:
 | Model Runner reference | docker/model-runner |
 | Dockerfile reference | moby/buildkit |
 | Engine API reference | moby/moby |
+| AI Governance API (`content/reference/api/ai-governance/api.yaml`) | docker/governor-services (private) |
 
 If a validation failure or broken link traces back to vendored content, note
 the upstream repo that needs fixing. Do not attempt to fix it locally.
 
+`content/reference/api/ai-governance/api.yaml` is a verbatim copy of the
+upstream `openapi.yaml` — do not edit it by hand. Re-vendor it with
+`hack/sync-governance-api.sh`, which fetches the latest spec from the private
+`docker/governor-services` repo (using your own `gh` auth).
+
 ## Writing guidelines
 
 Read and follow [STYLE.md](STYLE.md) and [COMPONENTS.md](COMPONENTS.md).