T-0.2 CI merge-gate pipeline + portable local runners (R-TEST-02/03, R-GITOPS-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

ci/lint.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# ci/lint.sh — Stage 1: yaml/lint. Runs in CI without a cluster (live now).
+# Lints all YAML in the repo against ci/yamllint.yaml.
+set -euo pipefail
+CI_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck disable=SC1091
+source "${CI_DIR}/lib.sh"
+
+log "Stage: yaml/lint"
+require_tool yamllint "Install: pip install 'yamllint==${YAMLLINT_VERSION}'"
+
+# Lint tracked + untracked (not yet committed) YAML; skip .git and artifact dirs.
+cd "$REPO_ROOT"
+mapfile -t files < <(
+  { git ls-files '*.yaml' '*.yml' 2>/dev/null
+    git ls-files --others --exclude-standard '*.yaml' '*.yml' 2>/dev/null
+  } | sort -u
+)
+# Fallback for a non-git checkout.
+if [ "${#files[@]}" -eq 0 ]; then
+  mapfile -t files < <(find . -path ./.git -prune -o \( -name '*.yaml' -o -name '*.yml' \) -print)
+fi
+if [ "${#files[@]}" -eq 0 ]; then
+  ok "no YAML files to lint"
+  exit 0
+fi
+
+yamllint -c "${CI_DIR}/yamllint.yaml" -f "${YAMLLINT_FORMAT:-standard}" "${files[@]}"
+ok "yaml/lint passed (${#files[@]} files)"