feat: consolidate forbid-artifacts into CI Gate

.github/workflows/ci.yml

@@ -162,17 +162,41 @@ jobs:
             echo "CHANGELOG.md is up to date."
           fi
 
+  forbid-artifacts:
+    name: Forbid artifacts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Fail if forbidden paths are tracked
+        run: |
+          set -euo pipefail
+          if git ls-files | grep -qE '(\.ssh/|\.db($|-)|.*\.sqlite|.*\.log$)'; then
+            echo "ERROR: forbidden files are tracked:"
+            git ls-files | grep -E '(\.ssh/|\.db($|-)|.*\.sqlite|.*\.log$)' || true
+            exit 1
+          fi
+      - name: Fail if history contains forbidden blobs
+        run: |
+          set -euo pipefail
+          if git rev-list --objects --all | grep -qE '(\.ssh/|.*\.db($|-)|.*\.sqlite|.*\.log$)'; then
+            echo "ERROR: forbidden artifacts exist in history:"
+            git rev-list --objects --all | grep -E '(\.ssh/|.*\.db($|-)|.*\.sqlite|.*\.log$)' || true
+            exit 1
+          fi
   gate:
     name: CI Gate
     runs-on: ubuntu-latest
-    needs: [test, lint, package]
+    needs: [test, lint, package, forbid-artifacts]
     if: always()
     steps:
       - name: All required checks passed
         run: |
-          if [[ "${{ needs.test.result }}"    != "success" ]] ||
-             [[ "${{ needs.lint.result }}"    != "success" ]] ||
-             [[ "${{ needs.package.result }}" != "success" ]]; then
+          if [[ "${{ needs.test.result }}"             != "success" ]] ||
+             [[ "${{ needs.lint.result }}"             != "success" ]] ||
+             [[ "${{ needs.package.result }}"          != "success" ]] ||
+             [[ "${{ needs.forbid-artifacts.result }}" != "success" ]]; then
             echo "::error::One or more required checks failed — merge blocked."
             exit 1
           fi