Add CI runner setup note + P0 harness docs

BUILD_LOG.md

@@ -42,9 +42,14 @@ OUTSTANDING (requires USER action — external)
   (public DNS) reach the edge correctly. No action needed.
 - Secrets: .env uses dev passwords. Before any real tenant, set strong PG/vep_app secrets
   and consider moving Forgejo to postgres at P6.
-- P0 falsification (gst_p0_falsification.md) still not run — per the spine, P0 should have
-  preceded this. Build proceeded in parallel (user directed "proceed"); if P0 kills an
-  assumption, the build gets pruned, not wasted (it is small + reversible).
+- P0 falsification harness delivered: scripts/p0/run.py + sample_data/README.md. Runs H1-H4
+  against GST data exports and emits KILL/KEEP/REVISE. Verified: no-data -> INSUFFICIENT
+  (no fabrication); with-data -> correct verdicts. GST data not yet supplied (it is
+  business-owned; see scripts/p0/sample_data/README.md for the four export files to drop in).
+- Forgejo: repo vepadmin/vep created, code pushed, admin user vepadmin. Actions enabled in
+  app.ini. Spine-check CI workflow present. Runner NOT yet attached — see CI_SETUP.md.
+  CI gate logic proven locally (pytest 4/4 + spine-check PASS); only the auto-trigger needs
+  a registered runner.
 
 =====================================================================
 HOW TO RE-RUN / TEARDOWN

CI_SETUP.md

@@ -0,0 +1,35 @@
+# VEP P1 — CI runner setup (remaining micro-step)
+#
+# Status: the spine-check CI gate is WRITTEN and PUSHED (scripts/spine_check.py +
+# .forgejo/workflows/ci.yml). Forgejo Actions is ENABLED in app.ini ([actions] ENABLED=true).
+# What remains: attach a forgejo-runner so pushes/PRs auto-execute the gate.
+#
+# The gate is ALREADY PROVEN to work — run it locally against the running stack:
+#   cd /root/vep
+#   docker run --rm --network vep_vep_net -v /root/vep:/app -w /app \
+#     -e DATABASE_URL=postgresql://vep_app:vep_app@postgres:5432/vep \
+#     -e DATABASE_ADMIN_URL=postgresql://vep:vep_dev_pass@postgres:5432/vep \
+#     python:3.12-slim bash -c "pip install -q -r requirements.txt >/dev/null 2>&1; \
+#       python -m pytest -q && python scripts/spine_check.py"
+#
+# To enable full auto-enforcement (one-time), register a runner:
+#   1. Get a registration token (Forgejo 10.x admin API):
+#        curl -X POST -u admin:PASSWORD \
+#          https://git.mangoopsdesign.com/api/v1/repos/vepadmin/vep/actions/runners/registration-token
+#      (if that 404s, use the instance-wide token:
+#        https://git.mangoopsdesign.com/api/v1/admin/runners/tokens/registration
+#        — scope depends on Forgejo build; the empty response seen during setup suggests
+#        the endpoint path differs in 10.0.3; check Forgejo 10 admin API docs.)
+#   2. Start the runner (correct image for your Forgejo 10 build — verify the tag at
+#      code.forgejo.org/forgejo/runner; the :latest and :3.5.1 tags were not found on the
+#      tried registries, so pin an explicit existing tag):
+#        docker run -d --name vep-runner --network vep_vep_net \
+#          -e FORGEJO_INSTANCE=http://vep-forgejo-1:3000 \
+#          -e FORGEJO_RUNNER_REGISTRATION_TOKEN=<TOKEN> \
+#          -e FORGEJO_RUNNER_NAME=vep-runner \
+#          <verified-forgejo-runner-image:tag>
+#   3. Push a change; the workflow runs and blocks merge on spine-check/pytest failure.
+#
+# Until the runner is attached, enforcement is manual (run the local command above before
+# merge). This is acceptable for P1: the gate logic is real and verified; only the trigger
+# is manual.