cr-gate workflow: PR bodies must carry the GLPI CR deep link

Reference implementation of the CR-gating ruling 2026-09-06.
Grep-safe env indirection (no injection through ${{ }} in shell).
Standard: https://projects.knownelement.com/issues/820#note-1

Ticket: https://projects.knownelement.com/issues/820

.gitea/workflows/cr-gate.yml

@@ -0,0 +1,22 @@
+# CR gate [#820] — reference implementation of the 2026-09-06 founder ruling:
+# a PR touching production must reference its GLPI CR deep link.
+# Org repos copy this file verbatim; standard documented on Discourse t/339.
+name: cr-gate
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
+jobs:
+  cr-link:
+    runs-on: ultix
+    container:
+      image: node:20-bookworm
+    steps:
+      - name: verify GLPI CR deep link in PR body
+        env:
+          PR_BODY: ${{ gitea.event.pull_request.body }}
+        run: |
+          echo "$PR_BODY" | grep -qE 'cmdb\.knownelement\.com/front/change\.form\.php\?id=[0-9]+' || {
+            echo "::error::PR body must reference the GLPI CR deep link (https://cmdb.knownelement.com/front/change.form.php?id=N) per the CR-gating ruling (Discourse t/339). Dev-only PRs: state 'no-CR (dev-only)' explicitly."
+            exit 1
+          }
+          echo "CR deep link present"

docker/stepca-prod/init-stepca.sh

@@ -22,7 +22,9 @@ ROOT_KEY="/root/ca-root/root.key"
 IMAGE="smallstep/step-ca@sha256:e9e8fa3262bf37b130962ffddbf6a64ac188f0bbb80959cf3ddc04c6bf294c3d"
 TAILNET_IP="$(tailscale ip -4)"
 
-[ -f "$ROOT_CRT" ] && [ -f "$ROOT_KEY" ] || { echo "FAIL: fleet root not found at $ROOT_CRT/$ROOT_KEY" >&2; exit 1; }
+if [ ! -f "$ROOT_CRT" ] || [ ! -f "$ROOT_KEY" ]; then
+  echo "FAIL: fleet root not found at $ROOT_CRT/$ROOT_KEY" >&2; exit 1
+fi
 [ -n "$TAILNET_IP" ] || { echo "FAIL: no tailscale IP" >&2; exit 1; }
 if [ -d "$DATA" ] && [ "${1:-}" != "--reinit" ]; then
   echo "FAIL: $DATA exists (pass --reinit to wipe and redo)" >&2; exit 1