release PR template: CR deep-link line per CR-gating ruling

GLPI CR reference now a required field (dev-only PRs declare no-CR).
Standard: https://projects.knownelement.com/issues/820
Ticket: https://projects.knownelement.com/issues/811

.gitea/pull_request_template.md

@@ -3,8 +3,13 @@
 Merging this deploys to production (pfv-bms restarts if packages/** or
 configuration.yaml changed).
 
+### Change management (ruling 2026-09-06 — mandatory)
+- GLPI CR deep link (required): https://cmdb.knownelement.com/front/change.form.php?id=N
+  - Dev-only PRs: state `no-CR (dev-only)` explicitly.
+
 ### Gate checklist (branch protection enforces the mechanical parts)
 - [ ] CI green on the head commit (yamllint + secret scan + SDLC suite)
+- [ ] CR filed in GLPI and referenced above (production changes)
 - [ ] Adversarial pass done: what breaks if this is wrong? what watches for it?
 - [ ] post-deploy validation (#778) will run on restart — expected entity changes noted below