feat(ci): wire var-go/oath gate into CI (#1)

Adds an oath job to cd.yml: on pull_request, checks out swedsl (the
vargo-gate source — its oath submodule isn't go-installable, module
path isn't a real import path) and runs cmd/vargo-gate against this
repo's linked issue, posting a var-go/oath commit status.

Deliberately NOT required by branch protection: vargo-gate's candidate
is still a hardcoded toy self-test registry (swedsl's own #9 fixture),
not a real PR-diff checker, so it fails closed against any real oath
until swedsl ships an Executor (swedsl#27). Requiring it now would
permanently block every cad-atlas PR. Disclosed in the CI config
comment, PROJECT.md, and docs/INCEPTION-OATH.md (honest-stub
discipline).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/cd.yml

@@ -53,6 +53,50 @@ jobs:
       - name: Run checks
         run: task check
 
+  oath:
+    name: var-go/oath
+    needs: guard
+    # Only a real pull_request event carries a linked-issue oath to gate (mirrors
+    # swedsl's own oath job, .gitea/workflows/ci.yml). v1 simplification (swedsl#30):
+    # the oath issue number is the PR's OWN number.
+    #
+    # DISCLOSED LIMITATION (honest-stub discipline, see docs/INCEPTION-OATH.md S3 and
+    # knowledge/swedsl-vargo-sprint1-enforcement-teeth-verdict.md): cmd/vargo-gate's
+    # candidate is a hardcoded toy self-test registry (swedsl's own #9 fixture
+    # vocabulary), not a real PR-diff checker. It will fail closed against any oath
+    # that isn't that toy vocabulary — which is every real oath, including this repo's
+    # own #1. A red or green "var-go/oath" status here currently proves the WIRING
+    # (fetch issue -> gate -> post commit status) runs end-to-end on a real PR, not
+    # that the PR satisfies its linked issue's oath. Deliberately NOT required by
+    # branch protection until swedsl ships a real-diff Executor (swedsl#27) — making
+    # it required now would permanently block every cad-atlas PR.
+    if: needs.guard.outputs.is_template != 'true' && github.event_name == 'pull_request'
+    runs-on: self-hosted
+    steps:
+      - name: Checkout swedsl (var-go source — not go-installable, module path isn't a real import path)
+        uses: actions/checkout@v4
+        with:
+          repository: mathias/swedsl
+          path: swedsl
+          token: ${{ secrets.DMABE_GITEA_API_TOKEN }}
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: swedsl/oath/go.mod
+          cache: false
+
+      - name: Run vargo-gate (fetch -> gate -> post status against this PR)
+        working-directory: swedsl/oath
+        env:
+          VARGO_GITEA_BASEURL: ${{ github.server_url }}
+          VARGO_GITEA_OWNER: ${{ github.repository_owner }}
+          VARGO_GITEA_REPO: cad-atlas
+          VARGO_GITEA_ISSUE: ${{ github.event.pull_request.number }}
+          VARGO_GITEA_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          export DMABE_GITEA_API_TOKEN='${{ secrets.DMABE_GITEA_API_TOKEN }}'
+          go run ./cmd/vargo-gate
+
   build:
     name: Build & Import
     needs: [guard, check]