Feat/rh forge UI target

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,52 @@
+<!--
+Every PR needs a ledger companion. See AGENTS.md §3.
+If this PR genuinely needs none (typo, dep bump, docs-only), write:
+    Ledger: none — <reason>
+-->
+
+## What
+
+<!-- One or two sentences. What changed, and why it needed to change. -->
+
+## Ledger
+
+<!--
+Link the task/bug/ADR file(s) this PR carries. At least one, or an explicit `none` with a reason.
+
+- Task:     docs/tasks/done/<file>.md      (moved from current/ in this PR)
+- Bug:      docs/bugs/fixed/<file>.md      (moved from open/ in this PR)
+- Decision: docs/decisions/ADR-NNNN-<file>.md
+-->
+
+- Task:
+- Bug:
+- Decision:
+- Jira: <!-- optional, opened on demand — see AGENTS.md §3 "Companion Jira". Omit or write "n/a". -->
+        <!-- If you opened one, put this PR's ledger path in the Jira issue too. -->
+
+<!--
+The ledger file is required. The Jira issue is not — open one when the work needs to be visible
+outside this repo, assigned, or linked to other Jira work. Don't file one just to fill this line.
+-->
+
+
+## Evidence
+
+<!--
+Required for anything moving to done/ or fixed/. Not prose — artifacts.
+What proves this works? Test names, job URLs, before/after output, artifact paths.
+"Tested manually" is not evidence.
+-->
+
+- [ ] `make test-unit` passes
+- [ ] `make test` passes
+- [ ] New logic has tests in this PR (or: N/A because …)
+- [ ] Acceptance Criteria in the ledger file are checked off, with evidence recorded **in the file**
+
+## Risk
+
+<!--
+What could this break, and how would we notice? Say "none" only if you mean it.
+Call out anything touching: run-metadata.yaml writes, scoring, the CI state machine,
+or the target-repo clone/PR path.
+-->

.github/workflows/ledger.yml

@@ -0,0 +1,71 @@
+# The first CI this repo has had. See ADR-0034, and
+# docs/bugs/open/bug-repo-does-not-meet-own-standards.md — a repo whose purpose
+# is enforcing lint and tests on other repos had neither for itself.
+name: tests and ledger
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    name: unit tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: Set up Python
+        run: uv python install 3.11
+
+      - name: Install dependencies
+        run: uv sync --all-extras --dev
+
+      - name: Run unit tests
+        run: make test-unit
+
+  ledger:
+    name: ledger consistency
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Need the base commit to diff against for the companion check.
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install PyYAML
+        run: pip install --quiet pyyaml
+
+      # Blocking: the ledger must be internally consistent. A broken link or a
+      # status that disagrees with its directory is a real defect.
+      - name: Validate the ledger
+        run: python3 scripts/check_ledger.py --all
+
+      # Advisory for now: warns when a code change has no task/bug/ADR
+      # companion. Flipping this to blocking is its own task —
+      # docs/tasks/pending/task-make-ledger-check-blocking.md
+      - name: PR companion check (advisory)
+        if: github.event_name == 'pull_request'
+        continue-on-error: true
+        env:
+          PR_BODY: ${{ github.event.pull_request.body }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          printf '%s' "$PR_BODY" > /tmp/pr-body.txt
+          python3 scripts/check_ledger.py \
+            --diff "${BASE_SHA}..${HEAD_SHA}" \
+            --body /tmp/pr-body.txt