chore(governance): take orly 0.6.3

`orly doctor` now reports a managed file git refuses to track, not only one
missing from disk. This repository is why: .gitignore excluded
.claude/skills/ while .oracle/orly.json declared four files under it managed,
so every local checkout passed and CI failed on a clone that never had them.

Also carries the self-repair boundary — an agent repairs a finding on its own
only when the repair has exactly one form and the failure names it, and never
clears its own gate — and the evidence invariant, which was rendering only
for repositories that select persona.indy.

DOC-33 now lists the checks that run rather than ten that were wished for,
and the date rules say where each applies.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>