chore(cicd): onboard kit to CON-CICD-001 (manifest+hooks)

.cicd-conformance.yaml

@@ -0,0 +1,39 @@
+# CON-CICD-001 conformance manifest — deployable repo
+# Generated by goblin_infra/scripts/scaffold-conformance-manifest.sh on 2026-05-01T23:51:52Z
+# All stages start `implemented: false`. Owning agent flips each to true as the
+# stage gets a passing test, and updates evidence_link.
+constitution: CON-CICD-001
+repo: kit
+non_deployable: false
+runtime: node
+framework_ref: 65212ac2cf2596cf4a41848af77bc8a9f61601b0
+policy_ref: 95a56ae69942b5575cf20f3d8131c872c6746c32
+owner: TBD
+deploy_workflows_detected: false
+stages:
+  plan_validation:
+    implemented: false
+    evidence_link: null
+  pre_merge_gates:
+    implemented: false
+    evidence_link: null
+  build:
+    implemented: false
+    evidence_link: null
+  promote:
+    implemented: false
+    evidence_link: null
+  deploy:
+    implemented: false
+    evidence_link: null
+  verify:
+    implemented: false
+    evidence_link: null
+  evidence:
+    implemented: false
+    evidence_link: null
+  rollback:
+    implemented: false
+    evidence_link: null
+notes: |
+

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,78 @@
+<!--
+  Canonical PR template — propagated from
+  goblin_infra/templates/.github/PULL_REQUEST_TEMPLATE.md
+  via scripts/propagate-pr-templates.sh
+  Constitution: CON-CICD-001
+  Do not edit this file directly in downstream repos; edit the canonical
+  template here and re-run the propagator. Local repo extensions belong in
+  .github/PULL_REQUEST_TEMPLATE/<name>.md (selectable via the GitHub UI).
+-->
+
+## Summary
+
+<!-- Brief description of what this PR does — focus on intent, not the diff. -->
+
+## Type of Change
+
+- [ ] Bug fix (non-breaking change that fixes an issue)
+- [ ] New feature (non-breaking change that adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to change)
+- [ ] Documentation update
+- [ ] Refactor (no functional changes)
+- [ ] Chore (dependencies, config, etc.)
+
+## TDD Evidence
+
+CON-CICD-001 §3.2 requires a failing test → minimal change → passing test
+paper trail for every plan execution. Fill out the section that applies; delete the others.
+
+### Plan-level test (preferred)
+
+- Failing test (commit / file / line):
+- Minimal change (commit):
+- Passing test (commit / CI run URL):
+
+### No new behaviour (refactor / docs / ops)
+
+- Why no new behaviour: <!-- e.g. comment-only change, doc update, hook propagation -->
+- Existing test suite still green: <!-- CI run URL -->
+
+## Testing
+
+- [ ] Unit tests pass locally
+- [ ] Integration tests pass locally (if applicable)
+- [ ] Manual testing completed
+
+## Constitution Compliance
+
+- [ ] CON-CICD-001 §3.3: no `--update-secrets` / `--update-env-vars` / `--set-env-vars` / `--set-secrets` flags in deploy workflows (terraform owns Cloud Run env config).
+- [ ] `.cicd-conformance.yaml` updated if any stage's `implemented` flag changed.
+- [ ] Husky canonical hooks unchanged in this PR (or, if changed, updated via `goblin_infra/scripts/propagate-husky-hooks.sh --apply`).
+- [ ] CON-TESTING-001 (Testing Strategy) satisfied or N/A.
+
+## Rollback Plan
+
+<!-- Specific revert command, prior image tag, or terraform state to restore. -->
+
+## Checklist
+
+- [ ] My code follows the project's style guidelines
+- [ ] I have performed a self-review of my code
+- [ ] I have commented my code where necessary
+- [ ] I have updated documentation as needed
+- [ ] My changes generate no new warnings
+- [ ] Any dependent changes have been merged
+
+## Reviewer Checklist
+
+- [ ] Risk classification (low / medium / high) acknowledged.
+- [ ] If high-risk (live customer traffic): explicit founder ack noted in comments.
+- [ ] Evidence artefacts uploaded (where applicable).
+
+## Screenshots (if applicable)
+
+<!-- Add screenshots for UI changes -->
+
+## Notes for Reviewer
+
+<!-- Any additional context for Paul -->