S13: CI-CD review gate and run-review.sh (no ns1 auto-deploy)

.forgejo/workflows/review.yml

@@ -0,0 +1,15 @@
+name: review
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+jobs:
+  inventory:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: no-deploy
+        run: |
+          test -f cicd/GATE.md
+          grep -q "no auto-deploy" cicd/GATE.md || grep -q "forbidden" cicd/GATE.md
+          echo "docs and gate only; this workflow does not SSH to ns1"