cr-gate workflow: PR bodies must carry the GLPI CR deep link

Reference implementation of the CR-gating ruling 2026-09-06.
Grep-safe env indirection (no injection through ${{ }} in shell).
Standard: https://projects.knownelement.com/issues/820#note-1

Ticket: https://projects.knownelement.com/issues/820

.gitea/workflows/cr-gate.yml

@@ -0,0 +1,22 @@
+# CR gate [#820] — reference implementation of the 2026-09-06 founder ruling:
+# a PR touching production must reference its GLPI CR deep link.
+# Org repos copy this file verbatim; standard documented on Discourse t/339.
+name: cr-gate
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
+jobs:
+  cr-link:
+    runs-on: ultix
+    container:
+      image: node:20-bookworm
+    steps:
+      - name: verify GLPI CR deep link in PR body
+        env:
+          PR_BODY: ${{ gitea.event.pull_request.body }}
+        run: |
+          echo "$PR_BODY" | grep -qE 'cmdb\.knownelement\.com/front/change\.form\.php\?id=[0-9]+' || {
+            echo "::error::PR body must reference the GLPI CR deep link (https://cmdb.knownelement.com/front/change.form.php?id=N) per the CR-gating ruling (Discourse t/339). Dev-only PRs: state 'no-CR (dev-only)' explicitly."
+            exit 1
+          }
+          echo "CR deep link present"