ci: lint maintained source

.github/source-lint.json

@@ -0,0 +1,11 @@
+{
+  "markdown": [
+    "README.md",
+    "RELEASING.md",
+    "AGENTS.md"
+  ],
+  "exclude": [
+    "GuppyScreen/*"
+  ],
+  "notes": "Complements native repository checks. Managed Spec Kit files retain their dedicated integrity gate; imported snapshots and generated/native-checked surfaces are scoped separately."
+}

.github/workflows/source-lint.yml

@@ -0,0 +1,20 @@
+name: Source lint
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    uses: bolens/.github/.github/workflows/reusable-source-lint.yml@7603518f305fb76f7bb1b9979f2692521f633b82
+    with:
+      tooling-ref: 7603518f305fb76f7bb1b9979f2692521f633b82

RELEASING.md

@@ -37,3 +37,14 @@ before merging.
 Keep required checks available on every pull request. Filter expensive work
 inside jobs or use an always-running result job that rejects failures and
 cancellations. Update the protection settings when renaming required jobs.
+
+## Source lint
+
+The Source lint workflow checks maintained markdown files selected by
+[`.github/source-lint.json`](.github/source-lint.json) on every pull request
+and push to `main`. Existing native checks remain part of the merge gate.
+Use the [shared local reproduction instructions](https://github.com/bolens/.github/blob/7603518f305fb76f7bb1b9979f2692521f633b82/docs/source-lint.md)
+with the same tooling revision pinned in
+[the workflow](.github/workflows/source-lint.yml). Review exclusions when adding
+source files; generated and imported files retain their native validation.
+Require the new check to pass on the current PR head before merging.