refactor(ci): carve the CI action sources out to rac-ci [roadmap:rac-ci]

[tcballard]

PR-2 of 2 for the rac-ci move (companion to the now-merged asdecided/ci#1). Removes the CI action sources from rac-core and rewires the dogfood, per the rac-ci roadmap and ADR-096.

What this does

• Removes the in-repo wrappers now living in rac-ci: action.yml (watchkeeper), pr-gate-action/ (gatekeeper), validate-action/ (registrar), the reusable .github/workflows/watchkeeper.yml, and the two action-contract tests (those moved to rac-ci).
• Rewires the dogfood in pr-checks.yml: the watchkeeper / validate / gate jobs now run rac watchkeeper / rac validate --sarif / rac gate --sarif as direct source-install CLI steps (pip install -e .), mirroring the existing agent-rules/eval/doctor jobs. rac-core dogfoods the engine itself, not its own published wrappers — no dependency on a rac-ci tag.
• Drops the two action tests from the watchkeeper battery in tests.yml (the CLI tests test_watchkeeper.py / test_gate.py stay).
• Docs (watchkeeper.md, validation.md) point consumers at the rac-ci paths (itsthelore/rac-ci/<cap>/github@v1).
• Adds ADR-096 (rac-ci consolidation: capability × platform, source-install dogfood, v1 tagging) and links the rac-ci roadmap to it.

Versioned cutover

Old rac-core action references stay resolvable on their existing tags (itsthelore/rac-core@<oldtag>, …/validate-action@v0, …/pr-gate-action@v0); only @main and future tags drop the actions.

Gates (all green locally)

• rac validate rac/ exit 0 (332 artifacts)
• rac relationships rac/ --validate exit 0
• rac export rac/ --agent-rules --check exit 0
• rac review rac/ no priority 1–2 (health 94/100)
• Both workflows YAML-parse; the rewritten dogfood jobs run on this very PR.

Note

This PR's own pr-checks.yml run is the live test of the rewritten source-install dogfood jobs. main is protected, so it needs your review/approval. Merge with a merge commit.

Execution tracking: #228 (rac-ci item — completes it alongside rac-ci#1).

---

Generated by Claude Code

[tcballard]

Flagging as the remaining blocker for the rac-ci topology item (#238): rac-ci#1 is merged, so this rac-core half is what still holds the carve-out open — epic #228 already shows rac-ci ticked. It would be good to review/merge (protected main, maintainer approval needed) before cutting the next release, so the release ships the rewired source-install dogfood rather than the removed wrapper paths. Note the branch is now ~186 commits behind main and will need a rebase; the in-PR "ADR-096" numbering has since been taken (ADR-096 is external-target verification; rac-ci consolidation prose on main cites ADR-092), so the ADR file needs renumbering on rebase as the PR body anticipated.