S13: CI-CD review gate and run-review.sh (no ns1 auto-deploy)

cicd/GATE.md

@@ -0,0 +1,23 @@
+# CI-CD review gate
+
+ns1 deploy is **forbidden** until all of these are true:
+
+1. Forgejo Actions (or `cicd/run-review.sh`) is green on the commit SHA.
+2. A human records the SHA in this file's "Promoted" table (or a PR comment).
+3. Config on the host is a **signed** wrapper (`sig.alg=ed25519`).
+4. Admin-history cube has prev + new + diff for that config.
+
+There is **no** auto-deploy job. A future `deploy.yml` must `if: false` or
+require `workflow_dispatch` plus the promoted SHA.
+
+## Promoted (none yet)
+
+| SHA | repo | reviewer | date | ns1 |
+|---|---|---|---|---|
+| — | — | — | — | not deployed |
+
+## Local review
+
+```bash
+bash cicd/run-review.sh
+```