Public shape: contributor files, the release workflow with attestations, the kit on itself

.gitattributes

@@ -0,0 +1,3 @@
+# The scripts run under bash and python3: a checkout never converts their line endings.
+* text=auto eol=lf
+*.tgz binary

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,20 @@
+## Summary
+
+Which issue or change this is. One per pull request.
+
+## What changes
+
+The files and behaviour, in words.
+
+## Public surface
+
+`none`, or what changed in a command's output or options, the manifest schema (`templates/dev.schema.json`),
+a template, or a setting, and the tests and documentation changed with it.
+
+## Checks
+
+The summary block `scripts/dev/check.sh` printed (or `jpdev check`), and any check you ran another way.
+
+## Sign-off
+
+Every commit carries a Developer Certificate of Origin sign-off that matches its author.

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -1,9 +1,15 @@
 name: CI
 
+# The check list is dev.json, run by scripts/dev/check.sh (the kit's own vendored runner). The two
+# jobs keep their names, which branch protection requires: `lint` runs the cheap steps, `tests` the
+# kit's test run.
+
 on:
   push:
     branches: [main]
   pull_request:
+  # Called by release.yml, so the release runs the tagged commit's own jobs.
+  workflow_call:
 
 permissions:
   contents: read
@@ -16,32 +22,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - name: shellcheck
-        run: shellcheck -x -P ".:SCRIPTDIR" bin/* lib/*.sh templates/*.sh scripts/*.sh tests/*.sh tests/fixture/*.sh
-      - name: bash -n
-        run: |
-          set -eu
-          for file in bin/* lib/*.sh templates/*.sh scripts/*.sh tests/*.sh tests/fixture/*.sh; do
-            bash -n "$file"
-          done
-      - name: CLAUDE.md is generated from AGENTS.md
-        run: scripts/sync-agent-docs.sh --check
-      - name: The JSON and YAML documents parse
-        run: |
-          set -eu
-          python3 -c '
-          import glob, json
-          for path in glob.glob("templates/*.json") + glob.glob("examples/*.json") + glob.glob("tests/fixture/*.json"):
-              json.load(open(path, encoding="utf-8"))
-              print("parsed " + path)'
-      - name: No machine-local paths in tracked text
-        run: |
-          set -eu
-          if git grep -nE '(^|[^A-Za-z0-9_])/(home|tmp)/[A-Za-z0-9_.-]+'; then
-            echo 'a machine-local path is in tracked text'; exit 1
-          fi
-      - name: Whitespace
-        run: git diff --check "$(git hash-object -t tree /dev/null)" HEAD
+      # Whitespace; no machine-local path in tracked text; CLAUDE.md is AGENTS.md and the root
+      # copy starts with the template; every script parses; the JSON documents parse; shellcheck
+      # (the program the runner image carries).
+      - name: The lint steps of dev.json
+        run: scripts/dev/check.sh --all --only diff-check,local-paths,agent-docs,bash-n,json,shellcheck
 
   tests:
     name: tests
@@ -51,4 +36,4 @@ jobs:
         with:
           persist-credentials: false
       - name: The kit's tests (jpdev check and check.sh on the fixture, the caps, the record gate)
-        run: tests/run.sh
+        run: scripts/dev/check.sh --only tests