fix: security & integration hardening + unified CI workflow

## Code Changes (from original PR #16)

Security & integration improvements:
- Temporal filtering: semantic_retriever.rs (fact_invalid_at, event_time)
- Answer validation: query_router.rs (6-signal multi-signal validation)
- GRM context → facts: fact_extractor.rs + ingest_pipeline.rs
- Speaker extraction first: entity_extractor.rs (Zep alignment)
- Memorability gate: memorability_gate.rs
- Community metrics: community_metrics.rs
- Answer validator: answer_validator.rs

## CI Workflow (unified pattern from main)

Standardized to match all repos:
- test job: all branches + PRs (cargo test/check)
- build-push job: main push only (docker build + push)
- Install Node.js before checkout
- Install docker only in build-push
- Proper secrets handling (FORGEJO_REGISTRY_USER, TOKEN)

.gitea/workflows/build.yaml

@@ -49,35 +49,27 @@ jobs:
           SHORT_SHA=$(git rev-parse --short HEAD)
           echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
 
-      - name: Validate registry credentials
-        run: |
-          if [ -z "${{ secrets.FORGEJO_REGISTRY_USER }}" ] || [ -z "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" ]; then
-            echo "❌ ERROR: Registry secrets not configured"
-            echo "Set FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN in repo settings"
-            exit 1
-          fi
-          echo "✓ Registry credentials configured"
-
       - name: Registry login
         run: |
-          echo "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" | docker login "${{ env.REGISTRY }}" \
-            --username "${{ secrets.FORGEJO_REGISTRY_USER }}" --password-stdin
+          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
+            --username "${REGISTRY_USER}" --password-stdin
         env:
-          DOCKER_CONFIG: /tmp/docker-config
+          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
 
       - name: Build Docker image
         run: |
           docker build --no-cache \
-            -t "${{ env.IMAGE }}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${{ env.IMAGE }}:latest" \
+            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:latest" \
             -f Dockerfile \
             .
 
       - name: Push Docker image
         run: |
-          docker push "${{ env.IMAGE }}:${{ steps.sha.outputs.short_sha }}"
-          docker push "${{ env.IMAGE }}:latest"
-          echo "✓ Image pushed: ${{ env.IMAGE }}:${{ steps.sha.outputs.short_sha }}"
+          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          docker push "${IMAGE}:latest"
+          echo "✓ Image pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
 
       - name: Prune unused images
         run: docker image prune -a --force 2>&1 | tail -3 || true

README.md

@@ -99,4 +99,3 @@ See `config/default.toml` for:
 6. Document in API.md
 
 See `CLAUDE.md` for project context and constraints.
-# CI test 1788759975

REGISTRY_SETUP.md

@@ -1,78 +0,0 @@
-# Forgejo Registry Secrets Configuration
-
-## One-Time Setup (Org Level)
-
-All repos in the `rock` org share the same Forgejo registry credentials.
-
-### Configure at Organization Level
-
-1. Navigate to: https://forgejo.riotpiao.com/rock
-2. Click Settings (gear icon)
-3. Go to: Actions → Secrets
-4. Add these org-level secrets:
-   - **Name**: `FORGEJO_REGISTRY_USER`
-     **Value**: `rock`
-   
-   - **Name**: `FORGEJO_REGISTRY_TOKEN`
-     **Value**: `<your-forgejo-token>`
-
-### Get Your Forgejo Token
-
-1. Go to: https://forgejo.riotpiao.com/user/settings/applications
-2. Click "Generate New Token"
-3. Set scopes: `api`, `read:registry`, `write:registry`
-4. Copy the token value into the secret
-
-## Inheritance
-
-Once org-level secrets are set:
-- ✅ All repos in `rock` org automatically inherit them
-- ✅ No per-repo configuration needed
-- ✅ Workflows reference via `${{ secrets.FORGEJO_REGISTRY_USER }}`
-
-## Validation
-
-Each repo's CI workflow includes a validation step:
-
-```yaml
-- name: Validate registry credentials
-  run: |
-    if [ -z "${{ secrets.FORGEJO_REGISTRY_USER }}" ] || [ -z "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" ]; then
-      echo "❌ ERROR: Registry secrets not configured"
-      echo "Set FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN in org settings"
-      exit 1
-    fi
-    echo "✓ Registry credentials configured"
-```
-
-If secrets are missing, the validation step will fail with a clear error message pointing to this setup process.
-
-## Affected Repositories
-
-The following repos use these shared org-level secrets in their CI workflows:
-
-- rock/riotpiao.com
-- rock/homelab-frontend
-- rock/poimen-workflows
-- rock/poimen-memory
-- rock/kmsvc-manage
-
-All use the unified CI pattern:
-- `test` job: runs on all branches + PRs (no registry access)
-- `build-push` job: runs on main push only (requires registry credentials)
-
-## Troubleshooting
-
-### "Registry secrets not configured" error
-
-If CI fails with this error:
-1. Check org settings: https://forgejo.riotpiao.com/rock/settings/actions/secrets
-2. Verify both secrets exist and are not empty
-3. Re-trigger the workflow by pushing to main
-
-### "unauthorized" from docker login
-
-If you get `error response from daemon: unauthorized`:
-1. Check the token value is correct (copy-paste carefully)
-2. Verify token has `read:registry` and `write:registry` scopes
-3. Generate a new token if the old one expired