feat(ci): run the org's own code-quality suite on this repo (backend#1603)

[LukasWodka]

Closes backend#1603.

The gap

tracebloc/.github publishes code-quality.yml — including the action-pins job from #159 — to all 19 other repos, and never ran it on itself. Its only repo-local CI is actionlint.yml, whose own header scopes it: "Repo-local CI for this repo's OWN workflow files." actionlint type-checks expressions, validates needs:/uses: wiring and shellchecks every run: block — but it does not inspect action refs at all. That is why the exemption was invisible: there was a green check sitting where the missing one should be.

It already cost us

#168 — an otherwise correct fix for backend#1600 — reverts actions/checkout from its pinned commit SHA to the mutable @v4 tag, in advance-deploy-env.yml: the most-consumed reusable workflow in the org, running with PROJECTS_KANBAN_TOKEN in scope. action-pins exists to fail precisely that diff, and it didn't run. A human reading the diff caught it — the review path D10 was written to stop relying on.

Armed from day one, because the tree was measured first

check	measured on develop before writing this
action-pins	24 uses: refs across 23 workflows, zero violations
shellcheck --severity=error	clean over both shell scripts
house-rules.sh	"no findings across 2 file(s)"
ruff, gitleaks	not runnable locally — this PR is their first honest look

So soft-fail: false from the start. If ruff or gitleaks surfaces anything, it gets fixed or baselined in this PR rather than the gate being softened — the same bargain e2e-test-agent's caller records in its own comment. Expect this PR to be red until that's settled; that's the point of arming before merging.

action-pins-soft-fail: false is set explicitly rather than inherited, because it's the specific check whose absence let #168 through, and because every other repo consumes these workflows at @main and inherits whatever refs they pin.

Two decisions recorded in the file

1. actionlint.yml stays separate. The gates have deliberately different postures — actionlint blocks from day one against a tree cleaned in the same change; code-quality ships soft-fail: true for repos still clearing backlog. Folding them would force one posture on both. #1603 asked for this to be a decision rather than an accident.
2. No paths: filter. A path-filtered job never reports on a PR that touches nothing it watches, and a required check that never reports leaves that PR waiting forever — the trap actionlint.yml's own header warns about. This keeps the check eligible to be made required under #1276.

Also no secrets: inherit, per RFC-BACKEND-1405 Q5 — same-repo caller or not, the rule is about what a later secrets.X reference would silently gain.

Parent backend#1405.

---

Note

Low Risk
CI-only change that adds quality gates; may block PRs until ruff/gitleaks findings are fixed or baselined, with no runtime or security logic changes.

Overview
Adds code-quality-caller.yml so this repo finally runs the same code-quality.yml reusable workflow it publishes to the rest of the org (closes backend#1603). actionlint stays a separate required gate; this caller does not replace it.

The new workflow triggers on pull requests (opened/reopened/sync/ready_for_review) and workflow_dispatch with an optional whole-repo all-files scan. It calls tracebloc/.github/.github/workflows/code-quality.yml@main with python: true, shell: true, and soft-fail: false so shellcheck, house-rules, ruff, and gitleaks run as hard gates from day one. action-pins inputs are deliberately omitted until the six-job callee is on main, because unknown inputs cause a startup_failure on @main callers.

Concurrency cancels in-flight runs; permissions are contents: read only, with no secrets: inherit and no paths: filter so the check can be made required without silent skips.

^{Reviewed by Cursor Bugbot for commit d093a88. Bugbot is set up for automated code reviews on this repo. Configure here.}