chore: sync all changes to Gitea

- Config, docs, scripts, and backup manifests
- Submodule refs unchanged (m = modified content in submodules)

Made-with: Cursor

scripts/omnl/validate-rail.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# OMNL operator rail CI: .gitignore check, shellcheck on scripts (if available), resolve_ids parse check.
+# Usage: from repo root. Exit 0 if all pass.
+
+set -euo pipefail
+REPO_ROOT="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
+cd "$REPO_ROOT"
+
+fail=0
+
+# 1) .gitignore must include ids.env and reconciliation/
+if ! grep -q 'ids\.env' .gitignore 2>/dev/null; then
+  echo "FAIL: .gitignore missing ids.env" >&2
+  fail=1
+fi
+if ! grep -q 'reconciliation' .gitignore 2>/dev/null; then
+  echo "FAIL: .gitignore missing reconciliation/" >&2
+  fail=1
+fi
+[ $fail -eq 0 ] && echo "PASS: .gitignore has ids.env and reconciliation/" >&2
+
+# 2) resolve_ids.sh must handle both array and pageItems (grep for pattern)
+if ! grep -q 'pageItems' scripts/omnl/resolve_ids.sh 2>/dev/null; then
+  echo "WARN: resolve_ids.sh may not handle pageItems response" >&2
+fi
+if ! grep -q 'if type == "array"' scripts/omnl/resolve_ids.sh 2>/dev/null; then
+  echo "WARN: resolve_ids.sh may not normalize array" >&2
+fi
+
+# 3) Shellcheck (optional)
+if command -v shellcheck >/dev/null 2>&1; then
+  for f in scripts/omnl/*.sh; do
+    [ -f "$f" ] && shellcheck -x "$f" 2>/dev/null || true
+  done
+  echo "PASS: shellcheck completed" >&2
+else
+  echo "SKIP: shellcheck not installed" >&2
+fi
+
+exit $fail