Scaffold runbook-tutorials repo: intent, scope, agent rules, State Hub registration

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

.forgejo/workflows/ci-smoke.yaml

@@ -0,0 +1,29 @@
+# Canonical CI smoke template (tier 1 routing drill).
+# Copy to: .forgejo/workflows/ci-smoke.yaml in consumer repos.
+name: CI Smoke
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  host-smoke:
+    runs-on: self-hosted
+    steps:
+      - name: Routing probe (host runner)
+        run: |
+          set -eu
+          echo "repository=${GITHUB_REPOSITORY:-unknown}"
+          echo "sha=${GITHUB_SHA:-unknown}"
+          echo "runner=${RUNNER_NAME:-unknown}"
+          uname -a
+
+  container-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Routing probe (container label)
+        run: |
+          set -eu
+          echo "container-smoke ok for ${GITHUB_REPOSITORY:-unknown}"

.forgejo/workflows/work-records.yaml

@@ -0,0 +1,42 @@
+# Work-record validation gate (canon: work-record-types_v0.1.md, CUST-WP-0060-T04).
+# Copy to: .forgejo/workflows/work-records.yaml in consumer repos.
+# Validates all work-record YAML blocks (intake/decision/engagement + task ids)
+# against the canon kind registry and JSON schemas before they reach the hub.
+# Zero-config: repos without work records pass in seconds.
+# Uses archive checkout (no actions/checkout; non-root runner has no git).
+name: Work Records
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "**.md"
+      - ".forgejo/workflows/work-records.yaml"
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  validate:
+    # Runner substrate: ubuntu-latest maps to docker://node:20-bookworm (no
+    # python) — install python3 + deps via apt (same pattern as kaizen ci.yml).
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch repo + canon, validate work records
+        run: |
+          set -eu
+          apt-get update -qq >/dev/null
+          apt-get install -y -qq python3 python3-yaml python3-jsonschema wget >/dev/null
+          WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
+          REF="${GITHUB_SHA:-main}"; SHORT="${REF:0:7}"
+          BASE="https://forgejo.coulomb.social"
+          mkdir -p "$WORK/repo" "$WORK/canon"
+          # Forgejo archive endpoint accepts short SHA; full SHA can hang.
+          wget -qO "$WORK/repo.tar.gz" \
+            "${BASE}/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
+          tar xzf "$WORK/repo.tar.gz" -C "$WORK/repo" --strip-components=1
+          wget -qO "$WORK/canon.tar.gz" \
+            "${BASE}/coulomb/the-custodian/archive/main.tar.gz"
+          tar xzf "$WORK/canon.tar.gz" -C "$WORK/canon" --strip-components=1
+          python3 "$WORK/canon/tools/validate_work_records.py" \
+            --repo "$WORK/repo" --canon "$WORK/canon"