Packaging, rtut check, tests CI job; schemas move into the package (RBT-WP-0009-T02)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

.forgejo/workflows/tests.yaml

@@ -0,0 +1,36 @@
+# Runs the test suite and validates every runbook pack, attribute set, project and template.
+# Follows the fleet pattern of work-records.yaml: no actions/checkout (the runner has no git), the repo comes
+# from the Forgejo archive endpoint. The engine needs Python 3.12 (pyproject: requires-python), so the job runs in a
+# python:3.12 container instead of the node:20-bookworm default, which ships an older Python.
+# NOT YET RUN on a real runner: verify the first execution and adjust the container or label if the runner refuses it.
+name: Tests
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    container:
+      image: python:3.12-slim
+    steps:
+      - name: Fetch the repository, install, test and check
+        run: |
+          set -eu
+          apt-get update -qq >/dev/null
+          apt-get install -y -qq wget >/dev/null
+          WORK="$(mktemp -d)"; trap 'rm -rf "$WORK"' EXIT
+          REF="${GITHUB_SHA:-main}"; SHORT="${REF:0:7}"
+          BASE="https://forgejo.coulomb.social"
+          mkdir -p "$WORK/repo"
+          # Forgejo archive endpoint accepts short SHA; full SHA can hang.
+          wget -qO "$WORK/repo.tar.gz" "${BASE}/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
+          tar xzf "$WORK/repo.tar.gz" -C "$WORK/repo" --strip-components=1
+          cd "$WORK/repo"
+          python -m pip install -q -e ".[test]"
+          python -m pytest -q
+          python -m rtut check .