feat(ecosystem): adopt hub-core dependency and CI pin gate (CORE-WP-0009)

Import slugify_or_default from hub-core, add contract tests, vendor hub-core in
Docker/Forgejo CI, document metadata isolation and pagination deferral, and
align INTENT/SCOPE with three-repo stack.

.forgejo/workflows/image.yaml

@@ -1,3 +1,4 @@
+# Multi-repo Docker build — vendors hub-core like state-hub.
 name: Build and Publish Container Image
 
 on:
@@ -19,6 +20,7 @@ env:
   REGISTRY: forgejo.coulomb.social
   IMAGE_NAME: coulomb/core-hub
   DOCKER_HOST: tcp://127.0.0.1:2375
+  EXTRA_REPOS: "coulomb/hub-core@hub_core_src"
 
 jobs:
   build-and-push:
@@ -33,15 +35,32 @@ jobs:
           REF="${GITHUB_SHA:-main}"
           SHORT="${REF:0:7}"
           mkdir -p buildctx "${HOME}/bin"
-          wget -qO /tmp/repo.tar.gz \
+          wget -qO /tmp/primary.tar.gz \
             "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
-          tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
+          tar xzf /tmp/primary.tar.gz -C buildctx --strip-components=1
+          for spec in ${EXTRA_REPOS}; do
+            repo="${spec%@*}"
+            ctx="${spec#*@}"
+            wget -qO "/tmp/${ctx}.tar.gz" \
+              "https://forgejo.coulomb.social/${repo}/archive/main.tar.gz"
+            mkdir -p "/tmp/ctx-${ctx}"
+            tar xzf "/tmp/${ctx}.tar.gz" -C "/tmp/ctx-${ctx}" --strip-components=1
+          done
+          mkdir -p buildctx/_hub_core_src
+          cp -r /tmp/ctx-hub_core_src/pyproject.toml /tmp/ctx-hub_core_src/hub_core buildctx/_hub_core_src/
+          echo "${SHORT}" > buildctx/.ci-build-id
+          sed \
+            -e 's|^COPY pyproject.toml|COPY .ci-build-id /tmp/.ci-build-id\nCOPY pyproject.toml|' \
+            -e 's|COPY --from=hub_core_src pyproject.toml|COPY _hub_core_src/pyproject.toml|' \
+            -e 's|COPY --from=hub_core_src hub_core/|COPY _hub_core_src/hub_core/|' \
+            buildctx/Dockerfile > buildctx/Dockerfile.ci
           wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
             | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
           export PATH="${HOME}/bin:${PATH}"
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          docker build -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" buildctx
+          docker build --build-arg DEPS_LOCK_ID=2 -f buildctx/Dockerfile.ci \
+            -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" buildctx
           docker push "${IMAGE}:latest"
           docker push "${IMAGE}:main-${SHORT}"
           echo "pushed ${IMAGE}:latest and ${IMAGE}:main-${SHORT}"