feat-014: watch mode + CI-triggered central indexing

[kjoshi07]

Graduates FA-005. feat-004 made re-indexing cheap and incremental — this adds the two automatic triggers that keep the graph fresh, one per topology, with a hard wall between them.

Local — ckg watch (opt-in, embedded store only)

• Pure, clock-injected TriggerPolicy: on-commit (default; commit / branch switch, ignores plain saves), on-idle, on-save, interval, manual. Debounced + single-flight so bursts coalesce.
• Structural refresh only by default (embed_on_watch/enrich_on_watch off) — never burns embedding/LLM spend per save.
• Branch gating (watch.branches: watch feature branches, skip main/release/*), --status, --once.
• Refuses a central (store.central_root) or read-only store — the local/central split is enforced in the engine, not just documented. That's what keeps a dev's watch loop from racing writes into the shared graph.
• watchfiles fs-loop behind a lazy [watch] extra; base install stays lean.

Central — ckg ci init

• Scaffolds a self-contained, single-writer .github/workflows/ckg-index.yml (concurrency group) that indexes into the central store on merge-to-main + nightly. Managed-marker, idempotent, --print/--force.

Also fixes #148 (post-release false alarm)

postrelease.yml now runs off the Release workflow completing successfully (workflow_run) instead of the GitHub release: published event — under on-demand OIDC publishing the release exists before the artifact reaches PyPI, so the old trigger polled too early, 404'd ~10 min, and auto-opened a spurious failure issue every release.

Shape

New agentforge_graph.ingest.watch (policy · git-watch · branch gate · guard · filter · watchfiles source · runner) + agentforge_graph.ci (workflow scaffolder), framework-free (ADR-0001). watch: config block. Spec feat-014, design design-014, guide 12-watch-and-ci-indexing.md, release notes docs/release/0.6.3.md.

Validation

• Gate: 952 passed / 45 skipped / 94.65%; ruff + mypy clean.
• 53 new tests incl. the full trigger matrix (injected clock), branch gate, guard refusals, single-flight coalescing, CI scaffold discipline, and a real fs-watch E2E (actual watchfiles: a saved file gets indexed live).
• Manual E2E: a real git commit on a feature branch triggered a refresh that indexed the new symbol; ckg watch --status correctly reports the branch gate; ckg ci init writes a valid workflow.

CHANGELOG under [Unreleased]; version/date/README Status: roll in the follow-up release/0.6.3 PR.

🤖 Generated with Claude Code