ci+quality: structural gates (CI: 3 new; local: 7 new + .clang-tidy)

CI gates (active on every PR via .gitea/workflows/)
───────────────────────────────────────────────────
1. test-count consistency
   cpp-tests.yml gains a step after test-cgal that runs
   `scripts/check-test-counts.sh` against the just-built ./build dir
   (reuse via new BUILD_DIR env var, ~5 s overhead).  Drift between
   `doc/api/tests.md` and ctest reality now fails the PR.

2. End-to-end smoke
   `scripts/try_it.sh` (the documented user quick-start) is now part of
   the CGAL job, so README quick-start regressions fail the PR rather
   than silently breaking when users land.

3. Internal markdown link checker
   New `.gitea/workflows/markdown-links.yml` + `scripts/check-markdown
   -links.py`.  PRs that touch any *.md file run the check; main pushes
   trigger it too; a weekly cron catches external link rot.  Pure
   Python, no third-party action.  Validated against the current tree:
   122 internal links across 37 *.md files, 0 broken.

Local quality scripts (`scripts/quality/`, not in CI)
─────────────────────────────────────────────────────
* `license-headers.sh`   — `SPDX-License-Identifier: MIT` audit over
                            code/{include,src,tests}/.  Currently
                            reports 60/66 files missing it — that's
                            a follow-up; the script captures the
                            structural gap.
* `sanitizers.sh`        — ASan + UBSan over the fast test suite.
* `coverage.sh`          — gcov/lcov line + branch coverage of
                            code/include/, HTML report under
                            build-coverage/lcov-html/.
* `clang-tidy.sh`        — runs the curated `.clang-tidy` policy over
                            every public header.
* `multi-compiler.sh`    — sequential build + test against every
                            detected g++/clang++ (auto-discovery or
                            explicit list).
* `cgal-version-matrix.sh`— sequential build + CGAL test suite against
                            every CGAL tree under `~/cgal/<ver>/` (or
                            via `CGAL_ROOTS=...` env var).
* `reproducible-build.sh`— two `Release -j1` builds, fail if any test
                            executable byte-differs.
* `run-all.sh`           — driver: `--fast` for the ~5-min subset,
                            no arg for the ~25–40 min full sweep;
                            captures per-gate logs to
                            build-quality-logs/.

+ `.clang-tidy`          — curated, deliberately-small policy (only
                            checks that fire on OUR code, never on
                            transitive CGAL/Eigen/Boost headers).

+ `scripts/quality/README.md` — explains the structure, lists each
                            gate's wall-time + prereqs, and codifies
                            the promotion path: a gate moves into CI
                            only when it's green on the dev machine
                            AND has a recovery-instructions paragraph
                            in `doc/release-policy.md`.

Doc updates
───────────
`doc/architecture/locked-vs-flexible.md` (reviewer-facing) gains 4
"closed" rows in the limitations table — the 3 CI gates above and the
local quality-script suite.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/quality/reproducible-build.sh

@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+# scripts/quality/reproducible-build.sh
+#
+# Build the project twice with the same toolchain + flags + sources, and
+# verify the two outputs are byte-identical (after stripping ABI noise).
+#
+# Why: conformallab++ is header-only, so the binaries we ship are just
+# the test executables.  If the same source + same toolchain produces
+# different bytes, something non-deterministic snuck in:
+#   * a `__DATE__` / `__TIME__` macro in the code
+#   * an absolute path leaked into a string literal
+#   * iteration over an unordered container of items
+#   * a parallel build with non-deterministic linking order
+#
+# Local-only.  Two full builds at ~3 min each ≈ 6 min wall time.
+#
+# Usage:
+#   bash scripts/quality/reproducible-build.sh
+#
+# Exit codes:
+#   0  the two builds produce byte-identical executables
+#   1  there is at least one differing byte; prints which executable(s)
+#   2  prerequisite missing
+
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT"
+
+DIR_A="build-repro-A"
+DIR_B="build-repro-B"
+
+# Identical-input check: nuke any state from a previous run.
+rm -rf "$DIR_A" "$DIR_B"
+
+# Use a fixed timezone + SOURCE_DATE_EPOCH so any time-based macros
+# yield identical strings in both builds.  Without this, even a perfect
+# build pipeline disagrees if __TIME__ slips in.
+export SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-1700000000}"
+export TZ=UTC
+export LC_ALL=C
+
+echo "========================================"
+echo "  Reproducible-build check"
+echo "  build A:  $DIR_A"
+echo "  build B:  $DIR_B"
+echo "  SOURCE_DATE_EPOCH:  $SOURCE_DATE_EPOCH"
+echo "========================================"
+echo
+
+build_once () {
+    local dir="$1"
+    cmake -S code -B "$dir" -DCMAKE_BUILD_TYPE=Release -Wno-dev >/dev/null
+    # Single-threaded build → deterministic link order.
+    cmake --build "$dir" --target conformallab_tests -j1 >"$dir/build.log" 2>&1
+}
+
+echo "── Build A ─────────────────────────────────"
+build_once "$DIR_A"
+echo "    done."
+
+echo "── Build B ─────────────────────────────────"
+build_once "$DIR_B"
+echo "    done."
+
+# ── Compare ─────────────────────────────────────────────────────────────────
+# Test executables live at:
+#   build-repro-*/conformallab_tests       (single combined fast test)
+#   build-repro-*/test_*                  (older per-suite executables)
+# Compare every regular file under each build dir that ends in
+# `_tests` or starts with `test_`.
+
+echo
+echo "── Diff ────────────────────────────────────"
+mismatches=""
+for path_a in "$DIR_A"/conformallab_tests "$DIR_A"/test_*; do
+    [ -f "$path_a" ] || continue
+    rel="${path_a#${DIR_A}/}"
+    path_b="$DIR_B/$rel"
+    if [ ! -f "$path_b" ]; then
+        echo "    MISS $rel  (only in build A)"
+        mismatches="$mismatches  $rel (missing in build B)
+"
+        continue
+    fi
+    if cmp -s "$path_a" "$path_b"; then
+        echo "    OK   $rel"
+    else
+        a_sha=$(shasum -a 256 "$path_a" | cut -d' ' -f1)
+        b_sha=$(shasum -a 256 "$path_b" | cut -d' ' -f1)
+        echo "    DIFF $rel"
+        echo "         A  $a_sha"
+        echo "         B  $b_sha"
+        mismatches="$mismatches  $rel
+"
+    fi
+done
+
+echo
+if [ -n "$mismatches" ]; then
+    echo "FAIL: the build is not byte-reproducible."
+    echo
+    echo "Differing files:"
+    printf "%s" "$mismatches"
+    echo
+    echo "Common causes:"
+    echo "  * __DATE__ / __TIME__ macros baked into the binary"
+    echo "  * absolute build path embedded in a debug-info string"
+    echo "  * a parallel-link race (-j > 1) — but we already use -j1 here"
+    echo "  * a header generated from a non-deterministic source"
+    echo
+    echo "Debug recipe:"
+    echo "  diff <(strings $DIR_A/$rel) <(strings $DIR_B/$rel) | head -20"
+    exit 1
+fi
+
+echo "OK: every test executable is byte-identical between the two builds."
+exit 0