feat: two-tier CI with Gourmand + Gatehouse gating external PRs

[fatherlinux]

Problem

External contributors don't have Gourmand or Gatehouse installed locally. Today, Gourmand runs in CI on all PRs (slowing down maintainers who already ran it), and Gatehouse doesn't run in CI at all. External PRs get no Gatehouse review and no guarantee Gourmand was run before submission.

Proposed Change

Amend the constitution to mandate a two-tier CI model for all CrunchTools projects:

Tier 1: Internal PRs (same-repo collaborators)

if: github.event.pull_request.head.repo.fork == false

Runs fast gates only:

• Lint (ruff)
• Type check (mypy)
• Tests (pytest)
• Container build
• Constitution validation

Maintainers are expected to run Gourmand + Gatehouse locally via pre-commit/pre-push hooks before pushing.

Tier 2: External PRs (forks)

if: github.event.pull_request.head.repo.fork == true

Runs everything in Tier 1 plus:

• Gourmand — AI slop detection (blocking)
• Gatehouse — 8-agent code review (blocking)

Both use GEMINI_API_KEY from repository secrets, which is safe because:

• Fork PRs use the pull_request trigger (not pull_request_target)
• Secrets are not passed to fork PR workflows
• The workflow that runs is the base branch version, not the fork's version
• Gatehouse's security agent should detect workflow exfiltration attempts (see feat: detect secret exfiltration in GitHub Actions workflow files gatehouse#4)

Local hooks for maintainers

Projects MUST provide installable hooks:

.hooks/pre-commit  → runs gourmand --full .
.hooks/pre-push    → runs gatehouse

With a setup target:

make install-hooks
# or
./setup-hooks.sh

Constitution Section to Add

New section (suggested XII) — Code Review Standards:

All CrunchTools projects MUST implement two-tier CI:

1. Internal PRs — lint, type check, tests, container build, constitution validation
2. External PRs — all of tier 1 plus Gourmand (AI slop detection) and Gatehouse (multi-agent code review) as blocking gates

Projects MUST provide .hooks/pre-commit (Gourmand) and .hooks/pre-push (Gatehouse) for local developer use.

Gemini Code Assist remains installed org-wide as a supplementary review layer but is not a substitute for Gourmand + Gatehouse.

Impact

All CrunchTools projects inheriting the constitution would need to:

1. Update .github/workflows/ci.yml with fork-conditional Gourmand + Gatehouse jobs
2. Add .hooks/pre-commit and .hooks/pre-push
3. Add GEMINI_API_KEY to repository secrets (if not already present)
4. Document hook installation in CLAUDE.md / README