Bootstrap GoreeCloud Code with Forgejo LTS source and governed foundation

[GoreeCloud]

Summary

• Import Forgejo v15.0.9 LTS tracked-source snapshot into vendor/forgejo/, preserving upstream LICENSE and recording origin/tag/SHA in UPSTREAM-SNAPSHOT.md.
• Establish the GoreeCloud Code Fork-to-Native architecture in the required GoreeCloud/code repository.
• Add loopback-only read-only Code API with server-side Forgejo credentials, strict fixed-route validation, safe field projection, bounded response handling and fail-closed request behavior.
• Add deterministic Node API tests, source-structure verifier, GitHub Actions validations and a development-only Glaze-oriented static preview.
• Document system boundaries, security, privacy, platform-contract migration, features, roadmap, and evidence status.

Verified evidence

• Forgejo import succeeded; resolved upstream SHA: 19b9b9d216bbfb501c18514bd1a8c980246ca3f7.
• Source tree, manifest, license and go.mod were read back on the branch.
• Candidate CI passed against 90ea6f5c40e5b8b3f054d631a8974e4819baf82c; subsequent exact-head checks must finish before review readiness.

Explicit non-claims / merge blockers

• No verified Forgejo executable build, source tag signature verification, license-completeness review, production deployment, live Forgejo API or database integration.
• No GoreeCloud Identity/Policy/Wardveil/Everkeep/Privacy Shield/Mesh/Observability/Manager acceptance.
• No official Glaze V1.7 consumer acceptance; static preview only.
• No validated migration, backup/restore, runner security or release readiness.
• The repository is a staged development Fork-to-Native, not a released native product.

Keep this PR in draft until upstream source provenance, build/security acceptance, appropriate review and exact-head required checks satisfy merge criteria. Follow-up work is tracked in #1. Do not represent green Node tests as full product acceptance.

Continued development: bounded repository reads

• Added owner-only, fail-closed repository allowlist (GOREECLOUD_CODE_ALLOWED_REPOSITORIES_FILE) and tests for invalid policy shapes, insecure permissions and symlink rejection.
• Repository read response is checked against the requested identity; cross-repository upstream mismatches return a sanitized error.
• Read-only Code API now maps limited branch, open issue and open pull summaries and strips unknown upstream fields. See Code read contract.
• Extended Code tests cover access denial, malformed provider responses, bounded projections, upstream identity mismatch, and mutation refusal.
• Code source validation passed for candidate 5a2a18b9d013576c75789131139d6252d25a938b.
• Source-level operation is not proof of live Forgejo API compatibility, user-level authorization, Glaze or platform conformance. This PR remains draft.

Next required checks

Run live Forgejo reads under least-privilege tokens, negative authorization tests against private repositories, full Forgejo build/security review, all nine applicable platform-system consumer gates, Glaze Stable acceptance, and Everkeep restore rehearsal. Exact-head Go verification is separately tracked in CI and must not be assumed from prior passing candidates.

Subsequent source acceptance evidence

• Imported Forgejo executable build succeeded on compatible source snapshot: https://github.com/GoreeCloud/code/actions/runs/37718277264.
• Glaze 1.7 source pin corrected; dependency check succeeds: https://github.com/GoreeCloud/code/actions/runs/37718641039.
• The Code UI preview and cross-document status checks are now in CI. A live-read smoke harness is available but has not been executed against a real Forgejo installation.

The PR stays draft. Compiled code and passing source checks are not release, privacy/security, Glaze consumer, or deployment approval.