CI: Establish source-first quality gate and simplify pipeline flow (#71)

This PR establishes a deterministic source-level quality gate before any build promotion and removes redundant post-build quality checks.

The new flow makes local developer workflow and CI behavior align:
- Developers run pre-commit locally (with auto-fix where appropriate)
- CI runs a check-only smoke gate to validate pre-commit cleanliness
- Build/test promotion only proceeds after source checks pass

## What Changed

### 1. Added a source-first quality gate

- Added a dedicated source gate workflow:
  - `.gitea/workflows/cicd-source-checks.yaml`
- Gate now:
  - Checks out target SHA
  - Bootstraps backend/frontend toolchains
  - Installs dependencies (`backend` via `uv`, `frontend` via `yarn`)
  - Runs `pre-commit --all-files` as the quality smoke test
- Downstream build dispatch only occurs if this gate passes.

### 2. Updated pipeline routing

- `cicd-start.yaml` now dispatches the source gate first.
- `cicd-start.yaml` push trigger now includes all branches so feature branches run the same gate.
- Added explicit routing logs in dispatch steps (route decision, SHA, trace id) for easier debugging.

### 3. Removed redundant checks workflow

- Removed:
  - `.gitea/workflows/cicd-checks.yaml`
- Updated:
  - `.gitea/workflows/docker-build-main.yaml` now dispatches `cicd-tests.yaml` directly after successful main build.

### 4. CI check-only behavior vs local auto-fix behavior

Updated `.pre-commit-config.yaml` so hooks that can auto-fix behave as:

- **Local developer pre-commit**: auto-fix enabled
- **CI source gate**: check-only (no auto-fix)

Applied to:
- `ruff` / `ruff-format`
- `eslint`
- `prettier`
- `tsdoc-lint`
- `markdownlint`
- `pretty-format-toml`

This keeps CI as a true smoke validation of local pre-commit compliance.

### 5. Renovate workflow hardening

- Improved auth/token handling and diagnostics in:
  - `.gitea/workflows/renovate.yml`
- Added support for internal/self-signed TLS endpoints used by this environment.

## Why

- Faster, earlier feedback on source quality failures
- Avoid expensive build/test progression when source hygiene fails
- Align CI with developer habits for predictable outcomes
- Remove duplicated quality checks and reduce pipeline complexity

## New Effective CI Flow

1. `cicd-start.yaml`
2. `cicd-source-checks.yaml` (pre-commit smoke gate)
3. `docker-build-base.yaml` / `docker-build-main.yaml`
4. `cicd-tests.yaml`

## Acceptance Criteria Mapping (Issue #60)

- Source-level lane runs independently and consistently: **Implemented**
- Source-lane failure blocks promotion: **Implemented**
- Outputs/logging are clear and actionable: **Implemented**

## Notes

- Source gate is intentionally check-only in CI.
- Developers should continue running local pre-commit before pushing.
- Any remaining failures in source gate indicate local pre-commit was not fully clean.

Co-authored-by: copilotcoder <copilotcoder@darkhelm.org>
Reviewed-on: #71

docs/CICD_MULTI_STAGE_BUILD.md

@@ -142,10 +142,13 @@ jobs:
 
 ### Responsibility Split
 
+- `.gitea/workflows/cicd-start.yaml` owns startup routing and trace propagation.
+- `.gitea/workflows/cicd-source-checks.yaml` owns early source-level
+  format/lint/type gating before any promotion dispatch.
 - `.gitea/workflows/docker-build-base.yaml` owns base publication and verification.
 - `.gitea/workflows/docker-build-main.yaml` owns complete-image publication.
-- `.gitea/workflows/cicd-start.yaml`, `.gitea/workflows/cicd-checks.yaml`, and
-  `.gitea/workflows/cicd-tests.yaml` own CI validation and checks.
+- `.gitea/workflows/cicd-checks.yaml` and `.gitea/workflows/cicd-tests.yaml`
+  own post-build CI validation and tests.
 - Main CI never rebuilds the base image locally.
 
 ### Runtime Boundary Enforcement

docs/DEVELOPMENT.md

@@ -390,8 +390,9 @@ pre-commit run end-of-file-fixer --all-files
 
 The CI/CD pipeline uses a **multi-stage build architecture** for optimal performance:
 
-- **Stage 1**: Build base image (system dependencies, Python, Node.js) - **cached across runs**
-- **Stage 2**: Build complete image (project code and dependencies) - **rebuilt every time**
+- **Stage 1**: Source-level fast checks (format, lint, type-check) - **hard promotion gate**
+- **Stage 2**: Build base image (system dependencies, Python, Node.js) - **cached across runs**
+- **Stage 3**: Build complete image (project code and dependencies) - **rebuilt every time**
 
 Pipeline triggers:
 
@@ -425,26 +426,19 @@ For detailed technical information, see [CI/CD Multi-Stage Build Architecture](C
 
 All jobs run in parallel after the setup phases:
 
-1. **Setup Base**: Builds and pushes base Docker image (conditional)
-2. **Setup Complete**: Builds and pushes complete CI/CD Docker image
-3. **Code Quality**:
-   - Trailing whitespace check
-   - End-of-file formatting
-   - YAML syntax validation
-   - TOML syntax validation
-4. **Backend Validation**:
-   - Ruff formatting check
-   - Ruff linting
-   - Pyright type checking
-   - Darglint docstring validation
-   - Unit tests with coverage
-   - Integration tests
-   - Doctests (xdoctest)
-5. **Frontend Validation**:
-   - Prettier formatting check
-   - ESLint linting
-   - TypeScript compilation
-   - Unit tests with coverage
+1. **Source Fast Gate**:
+   Backend source checks (Ruff format/lint, Pyright), frontend source checks (Prettier, ESLint, TypeScript), and dispatches downstream build only on success.
+
+2. **Setup Base**: Builds and pushes base Docker image (conditional)
+3. **Setup Complete**: Builds and pushes complete CI/CD Docker image
+4. **Code Quality**:
+   Trailing whitespace check, end-of-file formatting, YAML syntax validation, and TOML syntax validation.
+
+5. **Backend Validation**:
+   Ruff formatting check, Ruff linting, Pyright type checking, Darglint docstring validation, unit tests with coverage, integration tests, and doctests (xdoctest).
+
+6. **Frontend Validation**:
+   Prettier formatting check, ESLint linting, TypeScript compilation, and unit tests with coverage.
    - E2E tests (Playwright)
 
 ### Local CI/CD Testing