ci: require hosted repository verification

.github/workflows/verify.yml

@@ -0,0 +1,33 @@
+name: Verify
+
+on:
+  pull_request:
+  merge_group:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: verify-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install verification dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends --yes ffmpeg ripgrep
+
+      - name: Verify repository contract
+        run: ./scripts/verify.sh

README.md

@@ -79,7 +79,10 @@ npx --yes skills@1.5.14 add 'pbakaus/impeccable#skill-v3.9.1' \
 `WORKFLOW.md` keeps this repository usable by Autopilot and Symphony after the
 old catalog harness is removed. Its validation command is the small,
 non-mutating `scripts/verify.sh`; neither file is a registry or compatibility
-layer.
+layer. Pull requests, merge-queue entries, and updates to `main` run the same
+command on a standard GitHub-hosted Ubuntu runner. The `verify` job is the
+required status check for `main`; it uses read-only repository permissions and
+does not use repository secrets.
 
 The archived catalog system is preserved at Git tag
 `archive/catalog-system-final`.