feat(house): issue forms, token split, dependency auto-merge and CodeQL languages - #32

The Graphify check told pull request authors their graph was stale and to
update and commit it, printed twice, while the refresh job showed as
skipped, which read as a broken workflow. A graph one commit behind is
expected: refresh rebuilds it on the default branch after merge. The check
now prints the drift once as a notice and a job summary that says no action
is needed and what happens next, and the refresh job is named for why it is
skipped on pull requests. The workflows guide gains the common problems.

Refs: SMC-131

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Assisted-by: claude-code:claude-opus-5-5
Signed-off-by: Jonathan Stevens <jonathan@resnovas.com>

The aggregate smartcloud check waited for CodeRabbit and the Cursor agents
too, so a slow or neutral bot run could hold a merge, and the Cursor
approval agent, which waits for the checks, could deadlock with it. Review
bots only advise; the findings that block (AP-31) arrive as review comments
or the Graphify check, which still counts. The list goes in the
repository's own config rather than the house preset, because a list the
locked preset set could never be added to.

Refs: SMC-130

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Assisted-by: claude-code:claude-opus-5-5
Signed-off-by: Jonathan Stevens <jonathan@resnovas.com>

…nch's

CodeQL's language list came from GitHub's repository languages, which
describe the default branch, so a pull request that brought a repository's
first file in a new language went unscanned for it until after merge. The
languages job now adds the languages of the files a pull request or merge
queue entry adds or changes, by extension, skipping vendored and build paths
where a language with nothing to analyse would fail its job. A failed
comparison warns and falls back to the repository's languages.

Refs: SMC-126

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Assisted-by: claude-code:claude-opus-5-5
Signed-off-by: Jonathan Stevens <jonathan@resnovas.com>

… .github from a leaf repository

The synced smartcloud workflow minted the Resnovas Bot token with the app's
full permission set for the repository and Resnovas/.github on every
non-fork event, pull requests included, so a changed workflow in any
repository could write to the house repository.

It now mints a read-only token (permission-contents: read, repositories:
.github) on every trusted run, passed as houseToken for the preset and sync
templates, and the full app token, scoped to the repository alone, only on
push, schedule and dispatch runs of the default branch and on a merged
same-repository pull request's closed event, so backport pull requests
start CI. Fork and Dependabot runs mint neither and stay restricted. An
older smartcloud ignores the new input. Resnovas/.github is public, so the
docs no longer call it private; the house token stays so no privileged
token touches it and its reads use the app's rate limit. Access, workflows,
sync and troubleshooting docs and ai-docs describe the model.

Refs: SMC-128

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Assisted-by: claude-code:claude-opus-5-5
Signed-off-by: Jonathan Stevens <jonathan@resnovas.com>

Routine Dependabot and Renovate updates waited for someone to press merge
even when CI was green. The house preset now has an autoMerge rule that
turns on GitHub auto-merge for patch and minor updates, so they land through
the merge queue once the required checks pass; major updates still wait for
a person. Turning auto-merge on needs the right to merge, so the synced
smartcloud job asks for contents: write; it runs the published action, never
the pull request's code, and a fork's token stays read-only.

Refs: SMC-115

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Assisted-by: claude-code:claude-opus-5-5
Signed-off-by: Jonathan Stevens <jonathan@resnovas.com>

Describes how a repository that releases from conventional commits previews
the next release on each pull request: rebuild the squash commit, dry-run the
release tool with a read-only token, post one updated comment from a separate
job with only pull-requests: write, and never fail the pull request. It is a
report, not a check, so it needs no merge_group and stays out of the
aggregate. smartcloud is the worked example.

Refs: SMC-109

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Assisted-by: claude-code:claude-opus-5-5
Signed-off-by: Jonathan Stevens <jonathan@resnovas.com>

Anyone reading this repository as an example had no route to a guide for
building the same kind of hub for their own organisation. The README's
start table and getting-started now link to the new smartcloud guides (an
organisation's own sync hub, recommended setups, building the settings
file), and name the files here that serve as the full-size example.

Refs: SMC-147

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Assisted-by: claude-code:claude-opus-5-5
Signed-off-by: Jonathan Stevens <jonathan@resnovas.com>