work-records CI gate — CUST-WP-0060-T06 pilot

Wires the canon work-record validation workflow (repo-seed template).
Local proof: 45 records checked, 0 errors, 0 warnings — AWQ/DEC/OH ids
pass grandfathered, zero renames (the acceptance test for the
grandfathering design).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.forgejo/workflows/work-records.yaml

@@ -0,0 +1,39 @@
+# Work-record validation gate (canon: work-record-types_v0.1.md, CUST-WP-0060-T04).
+# Copy to: .forgejo/workflows/work-records.yaml in consumer repos.
+# Validates all work-record YAML blocks (intake/decision/engagement + task ids)
+# against the canon kind registry and JSON schemas before they reach the hub.
+# Zero-config: repos without work records pass in seconds.
+# Uses archive checkout (no actions/checkout; non-root runner has no git).
+name: Work Records
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "**.md"
+      - ".forgejo/workflows/work-records.yaml"
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  validate:
+    runs-on: self-hosted
+    steps:
+      - name: Fetch repo + canon, validate work records
+        run: |
+          set -eu
+          WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
+          REF="${GITHUB_SHA:-main}"; SHORT="${REF:0:7}"
+          BASE="https://forgejo.coulomb.social"
+          mkdir -p "$WORK/repo" "$WORK/canon"
+          # Forgejo archive endpoint accepts short SHA; full SHA can hang.
+          wget -qO "$WORK/repo.tar.gz" \
+            "${BASE}/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
+          tar xzf "$WORK/repo.tar.gz" -C "$WORK/repo" --strip-components=1
+          wget -qO "$WORK/canon.tar.gz" \
+            "${BASE}/coulomb/the-custodian/archive/main.tar.gz"
+          tar xzf "$WORK/canon.tar.gz" -C "$WORK/canon" --strip-components=1
+          python3 -m pip install --user --quiet pyyaml jsonschema
+          python3 "$WORK/canon/tools/validate_work_records.py" \
+            --repo "$WORK/repo" --canon "$WORK/canon"