Dogfood: run Gatekeep on this repo's PRs

Add .github/workflows/gatekeep-pr.yml with uses: ./ and
OPENROUTER_API_KEY from secrets. Forge-agnostic API helper for Gitea.

workflows/gatekeep-eval.yml

@@ -0,0 +1,14 @@
+# SAMPLE for the Action repo or consumers — prefer .github/workflows/gatekeep-eval.yml on Gitea.
+# Live dogfood eval workflow: .github/workflows/gatekeep-eval.yml
+
+name: Gatekeep evals
+
+on:
+  workflow_dispatch:
+
+jobs:
+  eval-floor:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+      - run: bash scripts/eval-floor.sh evals/cases defaults/policy.json

workflows/gatekeep-pr.yml

@@ -0,0 +1,33 @@
+# SAMPLE for *other* consumer repos — copy to .github/workflows/gatekeep-pr.yml
+#
+# On the Gatekeep dogfood repo itself, the live workflow is:
+#   .github/workflows/gatekeep-pr.yml  (uses: ./)
+#
+# Secrets: free-form names from providers.yaml `key` (e.g. OPENROUTER_API_KEY)
+
+name: Gatekeep
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, labeled]
+
+jobs:
+  gatekeep:
+    name: gatekeep
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
+        with:
+          persist-credentials: false
+
+      - name: Gatekeep review + verify
+        id: gk
+        # Consumer remote reference (not used for dogfood — dogfood uses ./ )
+        uses: https://git.potatolab.uk/layue13/gatekeep@main
+        env:
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-verify: "true"
+          retain-artifacts: "true"