Dogfood: run Gatekeep on this repo's PRs

Add .github/workflows/gatekeep-pr.yml with uses: ./ and
OPENROUTER_API_KEY from secrets. Forge-agnostic API helper for Gitea.

incidents/seed/example-incident.json

@@ -0,0 +1,20 @@
+{
+  "id": "INC-EXAMPLE-001",
+  "date": "2026-10-01",
+  "severity": "high",
+  "summary": "Workflow change under-tiered; unpinned action merged.",
+  "pr_url": "https://github.com/example/repo/pull/0",
+  "merge_sha": "0000000000000000000000000000000000000000",
+  "ai_tier_at_merge": "low",
+  "should_have_been_tier": "high",
+  "root_cause": "classifier_under_tier",
+  "models_at_review": [
+    "meta-llama/llama-3.3-70b-instruct:free",
+    "google/gemma-3-27b-it:free"
+  ],
+  "revert_pr_url": "https://github.com/example/repo/pull/1",
+  "revert_minutes": 12,
+  "eval_case_id": "must-stay-high-workflow",
+  "policy_change": "Keep .github/workflows/** in high_path_globs (seed policy).",
+  "notes": "Seed example only."
+}