feat(ecosystem): adopt hub-core dependency and CI pin gate (CORE-WP-0009)

Import slugify_or_default from hub-core, add contract tests, vendor hub-core in
Docker/Forgejo CI, document metadata isolation and pagination deferral, and
align INTENT/SCOPE with three-repo stack.

.forgejo/workflows/ci-smoke.yaml

@@ -1,5 +1,4 @@
-# Canonical CI smoke template (tier 1 routing drill).
-# Copy to: .forgejo/workflows/ci-smoke.yaml in consumer repos.
+# CI smoke with hub-core sibling vendored for path dependency resolution.
 name: CI Smoke
 
 on:
@@ -8,6 +7,9 @@ on:
       - main
   workflow_dispatch:
 
+env:
+  EXTRA_REPOS: "coulomb/hub-core@hub_core_src"
+
 jobs:
   host-smoke:
     runs-on: self-hosted
@@ -20,10 +22,30 @@ jobs:
           echo "runner=${RUNNER_NAME:-unknown}"
           uname -a
 
-  container-smoke:
-    runs-on: ubuntu-latest
+  pytest-smoke:
+    runs-on: self-hosted
     steps:
-      - name: Routing probe (container label)
+      - name: Test with vendored hub-core
         run: |
           set -eu
-          echo "container-smoke ok for ${GITHUB_REPOSITORY:-unknown}"
+          REF="${GITHUB_SHA:-main}"
+          SHORT="${REF:0:7}"
+          ROOT="${HOME}/ci-core-hub-${SHORT}"
+          rm -rf "${ROOT}"
+          mkdir -p "${ROOT}"
+          wget -qO /tmp/core-hub.tar.gz \
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
+          tar xzf /tmp/core-hub.tar.gz -C "${ROOT}" --strip-components=1
+          wget -qO /tmp/hub-core.tar.gz \
+            "https://forgejo.coulomb.social/coulomb/hub-core/archive/main.tar.gz"
+          mkdir -p "${ROOT}/../hub-core"
+          tar xzf /tmp/hub-core.tar.gz -C "${ROOT}/../hub-core" --strip-components=1
+          cd "${ROOT}"
+          if ! command -v uv >/dev/null 2>&1; then
+            pip install --user uv
+            export PATH="${HOME}/.local/bin:${PATH}"
+          fi
+          uv sync --extra dev
+          uv run python -c "import hub_core; assert hub_core.__version__ >= '0.2.0', hub_core.__version__"
+          uv run python -m pytest -q
+          echo "core-hub pytest smoke ok with hub-core @ ${SHORT}"

.forgejo/workflows/image.yaml

@@ -1,3 +1,4 @@
+# Multi-repo Docker build — vendors hub-core like state-hub.
 name: Build and Publish Container Image
 
 on:
@@ -19,6 +20,7 @@ env:
   REGISTRY: forgejo.coulomb.social
   IMAGE_NAME: coulomb/core-hub
   DOCKER_HOST: tcp://127.0.0.1:2375
+  EXTRA_REPOS: "coulomb/hub-core@hub_core_src"
 
 jobs:
   build-and-push:
@@ -33,15 +35,32 @@ jobs:
           REF="${GITHUB_SHA:-main}"
           SHORT="${REF:0:7}"
           mkdir -p buildctx "${HOME}/bin"
-          wget -qO /tmp/repo.tar.gz \
+          wget -qO /tmp/primary.tar.gz \
             "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
-          tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
+          tar xzf /tmp/primary.tar.gz -C buildctx --strip-components=1
+          for spec in ${EXTRA_REPOS}; do
+            repo="${spec%@*}"
+            ctx="${spec#*@}"
+            wget -qO "/tmp/${ctx}.tar.gz" \
+              "https://forgejo.coulomb.social/${repo}/archive/main.tar.gz"
+            mkdir -p "/tmp/ctx-${ctx}"
+            tar xzf "/tmp/${ctx}.tar.gz" -C "/tmp/ctx-${ctx}" --strip-components=1
+          done
+          mkdir -p buildctx/_hub_core_src
+          cp -r /tmp/ctx-hub_core_src/pyproject.toml /tmp/ctx-hub_core_src/hub_core buildctx/_hub_core_src/
+          echo "${SHORT}" > buildctx/.ci-build-id
+          sed \
+            -e 's|^COPY pyproject.toml|COPY .ci-build-id /tmp/.ci-build-id\nCOPY pyproject.toml|' \
+            -e 's|COPY --from=hub_core_src pyproject.toml|COPY _hub_core_src/pyproject.toml|' \
+            -e 's|COPY --from=hub_core_src hub_core/|COPY _hub_core_src/hub_core/|' \
+            buildctx/Dockerfile > buildctx/Dockerfile.ci
           wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
             | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
           export PATH="${HOME}/bin:${PATH}"
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          docker build -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" buildctx
+          docker build --build-arg DEPS_LOCK_ID=2 -f buildctx/Dockerfile.ci \
+            -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" buildctx
           docker push "${IMAGE}:latest"
           docker push "${IMAGE}:main-${SHORT}"
           echo "pushed ${IMAGE}:latest and ${IMAGE}:main-${SHORT}"