T-0.2 CI merge-gate pipeline + portable local runners (R-TEST-02/03, R-GITOPS-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

ci/Makefile

@@ -0,0 +1,46 @@
+# ci/Makefile — portable, single-command local equivalent of the Gitea Actions
+# merge gate (R-TEST-02: the gates are runnable TODAY, without Gitea).
+#
+# The Gitea Actions workflow (.gitea/workflows/merge-gate.yaml) calls these exact
+# scripts, so `make -C ci gate` locally == the CI merge gate. Run from anywhere:
+#   make -C ci gate
+#
+# Every stage is a thin wrapper over a ci/*.sh script; see ci/README.md.
+SHELL := /usr/bin/env bash
+CI_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
+
+.DEFAULT_GOAL := help
+
+.PHONY: help lint schema l0 l1 conformance gate all touched versions tools
+
+help: ## Show this help
+	@awk 'BEGIN{FS=":.*##"} /^[a-zA-Z0-9_-]+:.*##/{printf "  \033[36m%-14s\033[0m %s\n",$$1,$$2}' $(MAKEFILE_LIST)
+
+lint: ## yaml/lint (no cluster; live now)
+	@"$(CI_DIR)lint.sh"
+
+schema l0: ## ServiceDefinition schema validation + Kyverno L0 policy gate (no cluster; live now)
+	@"$(CI_DIR)l0.sh"
+
+l1: ## L1 rendering checks (no cluster; live now)
+	@"$(CI_DIR)l1.sh"
+
+conformance: ## L2/L3 in-cluster Chainsaw Job (SKIPS w/o CLUSTER_AVAILABLE=true)
+	@"$(CI_DIR)conformance.sh"
+
+gate: ## Full merge gate: all stages + R-TEST-03 decision (the single command)
+	@"$(CI_DIR)gate.sh"
+
+all: gate ## Alias for `gate`
+
+touched: ## Print the touched-requirement subset for the current branch vs main
+	@"$(CI_DIR)touched-requirements.sh"
+
+versions: ## Print pinned tool versions (R-TEST-02)
+	@cat "$(CI_DIR)versions.env"
+
+tools: ## Report which required tools are installed locally
+	@source "$(CI_DIR)versions.env"; \
+	for t in yamllint kyverno chainsaw kubectl yq git; do \
+	  if command -v $$t >/dev/null 2>&1; then printf "  \033[32mok\033[0m   %s\n" "$$t"; \
+	  else printf "  \033[33mmiss\033[0m %s\n" "$$t"; fi; done