Stability checkpoint — workflow rules dev/main + iris-common bump

- fix(ci): workflow rules dev/main allowlist includes .gitmodules + infra/common
- chore(submodule): bump iris-common SHA → 47484f4 (ADR-0066/0067/0068)

- ✅ Main pipeline #2517051527 success
- ✅ Auto-merge dev→main fires on submodule bumps

- iris-ui github main : branch protection bans force-push (manual sync only)