docs: add engineering best-practices (AI readiness) audit

[oly-agents]

Summary

Adds docs/engineering-best-practices-audit.md — an evidence-based AI-readiness audit of this
repo against the 49-item engineering best-practices checklist (rubric item-credit-v1,
2026-09-04) — and indexes it from the README under a new Repo Health section.

This is documentation only. No source, test, CI, or config behavior changes.

Headline results

Metric	Value
Critical gates	RED
Adjusted compliance	46.3% — (14 Met + 0.5 x 9 Partial) / (49 - 9 N/A)
Status counts	14 Met · 9 Partial · 17 Gap · 9 N/A

Critical gates are RED because of three items: AGENTS.md (absent), README setup & run
instructions (the README is a link index with no description, install, or dev-loop steps), and
required CI checks before merge — six jobs run on every PR, but org ruleset require-pr-review
(id 3174764) carries no required_status_checks rule, so a red build does not block a merge. The
other applicable gates (branch protection, secret scanning, SAST, unit tests, integration tests,
scoped secrets, lockfiles) are Met.

What the audit covers

• Profile — published Python library (src/ layout, hatchling wheel + git tag release),
  Python 3.10 / uv / ruff / pytest / poe, external surfaces Snowflake, S3, and
  Outerbounds; no deployed runtime, no owned schema, no UI. Ownership verified as patterninc,
  so inherited Wiz and Toolsmith controls apply (Wiz check runs observed on PR docs: document TABLE_OWNERSHIP_REGISTRY as a daily-refreshed table #34's head).
• Per-item verdicts for all 49 items with concrete evidence (file paths, CI job names,
  ruleset ids, observed check runs).
• 26 prioritized, ticket-ready recommendations sized S/M/L, critical gates first.
• 9 declined practices with profile-backed rationales (no service boundary, no UI, no local
  DB, nothing deployed, no owned schema).
• Beyond the checklist — strengths the rubric does not name, e.g. CI tests the built wheel
  rather than the source tree, and the Check Version job makes a forgotten version bump fail on
  a duplicate tag.

Notes for review

The audit is a snapshot of commit 60ea68e on main; open PRs (#33 mkdocs, #35 agent env config,
#36 Release Please) are referenced as in-flight but not credited as Met. CI does not run on this
PR — the workflow's paths-ignore excludes README.md and docs/**.

---

Oly run: https://oly.pattern.com/runs/01a08ef6-1ea4-74cc-9aa2-36cc47a9c05d
Requested by: amitkumar.tiwari@pattern.com