Dogfood: run Gatekeep on this repo's PRs

Add .github/workflows/gatekeep-pr.yml with uses: ./ and
OPENROUTER_API_KEY from secrets. Forge-agnostic API helper for Gitea.

defaults/policy.json

@@ -0,0 +1,30 @@
+{
+  "medium_path_globs": [
+    "**/package-lock.json",
+    "**/pnpm-lock.yaml",
+    "**/yarn.lock",
+    "src/**",
+    "lib/**",
+    "server/**",
+    "packages/**"
+  ],
+  "high_path_globs": [
+    ".github/workflows/**",
+    ".github/actions/**",
+    "**/Dockerfile*",
+    "**/*secret*",
+    "**/*credential*",
+    "**/auth/**",
+    "**/billing/**",
+    "**/payment/**",
+    "**/.env*",
+    "**/security/**",
+    "scripts/release/**"
+  ],
+  "low_max_files": 8,
+  "low_max_diff_lines": 200,
+  "force_high_labels": ["security", "do-not-automerge", "high-risk", "gatekeep:high"],
+  "force_medium_labels": ["needs-human", "medium-risk", "gatekeep:medium"],
+  "do_not_automerge_labels": ["do-not-automerge", "gatekeep:no-automerge"],
+  "security_agreement": "require_agreement_unless_scan_hard_fail"
+}