skeleton: package, schema, config, CLI, alembic, CI, deploy, docs

- cayceops core: env-only config (CAYCE_OPS_*), engine/session, ORM models
  with state machines (proposal/mail/content) and audited writes
- provider-agnostic LLM interface (null provider default, stdlib openai-compat)
- Typer CLI with lazy component loading (scanner/executor/maild/publisher/monitor)
- alembic 0001 initial schema; sqlite-portable JSON columns
- tests: 7 passing on throwaway sqlite; fixtures invented, never real data
- ci: ruff + alembic smoke + pytest + gitleaks(full history) in
  .gitea/workflows + .github/workflows; local gate = make check
- deploy: docker-compose (postgres 16) + hardened systemd units/timers
- docs: DECISIONS D1-D9; README project (grant text retired)

Makefile

@@ -0,0 +1,21 @@
+.PHONY: check lint test migrate-check leaks sync
+
+sync:            ## install locked deps (creates .venv)
+	uv sync --frozen
+
+lint:            ## ruff
+	uv run ruff check .
+
+test:            ## pytest
+	uv run pytest
+
+migrate-check:   ## smoke the alembic chain on a scratch sqlite db
+	rm -f /tmp/cayce-ops-migrate.db
+	CAYCE_OPS_DATABASE_URL=sqlite:////tmp/cayce-ops-migrate.db uv run alembic upgrade head
+	@rm -f /tmp/cayce-ops-migrate.db
+
+leaks:           ## gitleaks over the full history
+	gitleaks detect --source . --log-opts="--all" -v
+
+check: lint test migrate-check leaks   ## the pre-push gate — must be green before every push
+	@echo "check: OK"