Route every contract from the bootstrap

Add bom-decomposition and secret-management router entries, promote
git-sync-check to the always-on set, and move secret-management out of
always-on since it only matters when touching credentials or config.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

AGENT-BOOTSTRAP.md

@@ -23,8 +23,8 @@ Read these on most tasks:
 - `bible/rules/patterns/module-structure/contract.md`
 - `bible/rules/patterns/task-discipline/contract.md`
 - `bible/rules/patterns/testing-policy/contract.md`
-- `bible/rules/patterns/secret-management/contract.md`
 - `bible/rules/patterns/go-code-style/contract.md`
+- `bible/rules/patterns/git-sync-check/contract.md`
 
 ## Task Router
 
@@ -52,6 +52,10 @@ Read additional contracts by task type:
   `release-signing`
 - Identifiers, vendors, data normalization:
   `identifier-normalization`, `no-hardcoded-vendors`
+- BOM rows, component/LOT mappings:
+  `bom-decomposition`
+- Secrets, credentials, config with sensitive values:
+  `secret-management`
 - Project architecture documentation rules:
   `go-project-bible`