Implement reproducible S1 handoff contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

.forgejo/workflows/ci-smoke.yaml

@@ -9,6 +9,22 @@ on:
   workflow_dispatch:
 
 jobs:
+  source-contract:
+    runs-on: self-hosted
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+      - name: Validate S1 source contracts
+        run: |
+          set -eu
+          python3 -c 'import yaml'
+          python3 scripts/inventory_contract.py
+          python3 scripts/baseline_contract.py --check-repo
+          python3 scripts/sops_rotation.py --check
+          python3 scripts/s1_receipt.py docs/evidence/s1-receipts/*.json
+          python3 -m unittest discover -s tests -v
+          make check-secrets
+
   host-smoke:
     runs-on: self-hosted
     steps:
@@ -26,4 +42,4 @@ jobs:
       - name: Routing probe (container label)
         run: |
           set -eu
-          echo "container-smoke ok for ${GITHUB_REPOSITORY:-unknown}"
+          echo "container-smoke ok for ${GITHUB_REPOSITORY:-unknown}"