Dogfood: run Gatekeep on this repo's PRs

Add .github/workflows/gatekeep-pr.yml with uses: ./ and
OPENROUTER_API_KEY from secrets. Forge-agnostic API helper for Gitea.

.github/workflows/gatekeep-eval.yml

@@ -0,0 +1,30 @@
+# Floor evals on the Gatekeep Action repo itself.
+
+name: Gatekeep evals
+
+on:
+  push:
+    paths:
+      - "defaults/**"
+      - "config/**"
+      - "evals/**"
+      - "scripts/**"
+      - "action.yml"
+  pull_request:
+    paths:
+      - "defaults/**"
+      - "config/**"
+      - "evals/**"
+      - "scripts/**"
+      - "action.yml"
+  workflow_dispatch:
+
+jobs:
+  eval-floor:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+      - name: Run floor evals
+        run: bash scripts/eval-floor.sh evals/cases defaults/policy.json

.github/workflows/gatekeep-pr.yml

@@ -0,0 +1,45 @@
+# Dogfood: run Gatekeep on PRs to THIS repo (layue13/gatekeep).
+# Gitea Actions discovers workflows under .github/workflows/ (not /workflows/).
+#
+# Secret: OPENROUTER_API_KEY (already configured on this repo)
+# Action: in-repo composite at repository root (uses: ./)
+
+name: Gatekeep
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+
+jobs:
+  gatekeep:
+    name: gatekeep
+    runs-on: ubuntu-latest
+    # Skip drafts on pull_request; allow manual dispatch
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.draft == false
+    steps:
+      - name: Checkout PR / default branch
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+
+      - name: Gatekeep review (in-repo Action)
+        id: gk
+        # Local composite action — action.yml at repo root
+        uses: ./
+        env:
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-verify: "true"
+          retain-artifacts: "true"
+
+      - name: Job summary
+        if: always()
+        run: |
+          {
+            echo "## Gatekeep dogfood"
+            echo "risk_tier=${{ steps.gk.outputs.risk_tier }}"
+            echo "security_blocking=${{ steps.gk.outputs.security_blocking }}"
+            echo "agreed_count=${{ steps.gk.outputs.agreed_count }}"
+          } >> "$GITHUB_STEP_SUMMARY"