fix: self-reference workflow headers instead of pointing at .github's examples

.github/workflows/branch-retention.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/automation/branch-retention.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/branch-retention.yml
 # @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/ci.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/core-cicd/ci.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/ci.yml
 # @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/cla.yml

@@ -0,0 +1,60 @@
+#
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/cla.yml
+# @Date: 2026-07-19 00:00:00 -07:00 (1784523600)
+# @Author: Nate Corcoran <CLDMV>
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/cla.yml
+#
+# Per-CLA-version signing with per-repo override support. Each commit author
+# must either:
+#   - Be in the org (silent pass via /orgs/CLDMV/members lookup)
+#   - Be in the exempt-bots list
+#   - Already have a signature record at the active (scope, version) in the
+#     central ledger repo (default: CLDMV/.cla-signatures)
+#   - Reply on this PR with the exact required text
+#
+# Default vs. override scope:
+#   - DEFAULT (this repo has NO root-level CLA.md): the bot uses the org-wide
+#     CLA at cla-versions/v<X.Y>.md in the ledger. Signing once covers every
+#     CLDMV repo that uses the default until the major.minor is bumped.
+#   - OVERRIDE (this repo HAS a root-level CLA.md): the bot enforces the
+#     consumer-repo text and reads the version from its header. Signatures
+#     live under signatures/<platform>/overrides/<owner>/<repo>/v<X.Y>/ and
+#     are scoped to this repo only.
+#
+# Required setup:
+#   - Bot App must have `Organization permissions → Members: read` for the
+#     org-member exemption.
+#   - Bot App must have `Repository contents: write` on the ledger repo.
+#   - Optional `CLDMV_CLA_BOT_APP_CLIENT_ID` / `CLDMV_CLA_BOT_APP_PRIVATE_KEY`
+#     org secrets override the general bot identity for CLA actions only.
+name: 📜 CLA
+
+on:
+    pull_request_target:
+        types: [opened, synchronize, reopened, ready_for_review]
+    issue_comment:
+        types: [created]
+
+permissions:
+    contents: read
+    pull-requests: write
+    statuses: write
+    issues: write
+
+jobs:
+    cla:
+        uses: CLDMV/.github/.github/workflows/reusable-cla.yml@v4
+        with:
+            cla_version: "1.0"
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
+            CLA_BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_CLA_BOT_APP_CLIENT_ID }}
+            CLA_BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_CLA_BOT_APP_PRIVATE_KEY }}
+            TAGGER_NAME: ${{ secrets.CLDMV_BOT_NAME }}
+            TAGGER_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}

.github/workflows/codeql.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/security/codeql.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/codeql.yml
 # @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/dependabot-auto-merge.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/automation/dependabot-auto-merge.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/dependabot-auto-merge.yml
 # @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/dependency-review.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/security/dependency-review.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/dependency-review.yml
 # @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/hotfix-redirector.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/release-flow-v4/hotfix-redirector.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/hotfix-redirector.yml
 # @Date: 2026-05-22 00:00:00 -07:00 (1779778800)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/hotfixes-release.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/release-flow-v4/hotfixes-release.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/hotfixes-release.yml
 # @Date: 2026-05-22 00:00:00 -07:00 (1779778800)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/labeler.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/automation/labeler.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/labeler.yml
 # @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/master-commit-audit.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/release-companions/master-commit-audit.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/master-commit-audit.yml
 # @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/next-release.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/release-flow-v4/next-release.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/next-release.yml
 # @Date: 2026-05-22 00:00:00 -07:00 (1779778800)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/next-reset.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/release-flow-v4/next-reset.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/next-reset.yml
 # @Date: 2026-05-22 00:00:00 -07:00 (1779778800)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/pr-title-normalizer.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/release-flow-v4/pr-title-normalizer.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/pr-title-normalizer.yml
 # @Date: 2026-05-22 00:00:00 -07:00 (1779778800)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/publish.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/core-cicd/publish.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/publish.yml
 # @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/release-notify.yml

@@ -0,0 +1,37 @@
+#
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/release-notify.yml
+# @Date: 2026-07-19 00:00:00 -07:00 (1784523600)
+# @Author: Nate Corcoran <CLDMV>
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/release-notify.yml
+#
+# Fires on `release: published` and dispatches the release announcement to
+# any enabled webhook. No config file — each channel is just a secret:
+#
+#   DISCORD_RELEASES_PUBLIC_WEBHOOK   / DISCORD_RELEASES_PRIVATE_WEBHOOK
+#   SLACK_RELEASES_PUBLIC_WEBHOOK     / SLACK_RELEASES_PRIVATE_WEBHOOK
+#   GENERIC_RELEASES_PUBLIC_WEBHOOK   / GENERIC_RELEASES_PRIVATE_WEBHOOK
+#
+# Visibility is determined automatically from the repo: GitHub `public` →
+# PUBLIC, `private` or `internal` → PRIVATE. Set the org-level secret in
+# CLDMV for the default URL; set a repo-level secret with the same name to
+# override (or to an empty string to mute that channel for this repo).
+name: 📣 Release Notify
+
+on:
+    release:
+        types: [published]
+
+permissions:
+    contents: read
+
+jobs:
+    notify:
+        # Defensive: skip untagged releases (mirrors Batch 1.2's filter)
+        if: github.event.release.tag_name != ''
+        uses: CLDMV/.github/.github/workflows/reusable-release-notifier.yml@v4
+        secrets: inherit

.github/workflows/scorecard.yml

@@ -0,0 +1,61 @@
+#
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/scorecard.yml
+# @Date: 2026-07-19 00:00:00 -07:00 (1784523600)
+# @Author: Nate Corcoran <CLDMV>
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/scorecard.yml
+#
+# OpenSSF Scorecard — scans the repo against ~18 security best-practice checks
+# and produces a 0-10 score. Thin caller: the steps and the SHA-pinned
+# scorecard-action version live in reusable-scorecard.yml@v4, so the action
+# version can't drift in this copy (it just calls the org reusable). Triggers
+# stay here, per OpenSSF's recommended setup.
+#
+# NOTE: this MUST stay a thin caller. OSSF Scorecard's publish step verifies
+# the analysis job and allows only a fixed set of steps; the inline form used
+# our checkout-code composite, which trips "job has unallowed step" -> publish
+# HTTP 400. The reusable uses actions/checkout directly, which passes.
+name: 🔬 OpenSSF Scorecard
+
+on:
+    branch_protection_rule:
+    schedule:
+        - cron: "32 7 * * 1" # weekly Monday 07:32 UTC
+    push:
+        branches: [master, main]
+    workflow_dispatch:
+
+# Caller must grant what the reusable needs — notably id-token: write for the
+# OpenSSF transparency-log publish.
+#
+# No workflow-level `permissions:` here — grant on the `analyze` job below
+# instead. scorecard-action's publish step verifies that write permissions
+# were granted JOB-scoped, not workflow-wide (matching OSSF's own example:
+# https://github.com/ossf/scorecard-action#example-workflow). A workflow-level
+# grant satisfies GitHub's own reusable-workflow permission rules fine, but
+# still trips scorecard-action's own check — the rejection ("workflow
+# verification failed: global perm is set to write: permission for X is set
+# to write") means "granted globally," not "forbidden."
+#
+# Do NOT add security-events: write here while publish_results: true below.
+# scorecard-action's publish step rejects submissions from a workflow whose
+# token has security-events write access (it verifies the caller can't have
+# tampered with results before they hit the public transparency log). That
+# trade-off means the reusable's own SARIF-to-Security-tab upload step has no
+# permission to run in this configuration; the public OpenSSF badge is the
+# thing actually enabled here, so this repo takes that trade-off. Only add
+# security-events: write back (job-scoped) if publish_results is set to false
+# instead.
+jobs:
+    analyze:
+        permissions:
+            id-token: write
+            contents: read
+            actions: read
+        uses: CLDMV/.github/.github/workflows/reusable-scorecard.yml@v4
+        with:
+            publish_results: true # set false for private repos / to skip the public badge

.github/workflows/stale.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/automation/stale.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/stale.yml
 # @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/tag-health.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/release-companions/tag-health.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/tag-health.yml
 # @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/update-major-version-tags.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/core-cicd/update-major-version-tags.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/update-major-version-tags.yml
 # @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/v4-bootstrap.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/release-flow-v4/v4-bootstrap.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/v4-bootstrap.yml
 # @Date: 2026-05-26 00:00:00 -07:00 (1780124400)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>

.github/workflows/welcome.yml

@@ -1,6 +1,6 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/automation/welcome.yml
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/welcome.yml
 # @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>