Vendor shared SEO rule engine + CI drift guard (no pipeline wiring yet)

src/seo/rules.py is a byte-for-byte copy of the canonical seo_rules.py
(git.chemavx.xyz/chemavx/chemavx-seo-tools). CI step "Verify vendored SEO engine"
clones the canonical and fails the build on any divergence; `make sync-seo` /
`make check-seo-sync` cover the local-canonical workflow. Nothing imports this in
a runtime path yet — generate_seo_fields integration comes next behind SEO_AUTOFILL.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -20,6 +20,21 @@ jobs:
         with:
           ssl-verify: false
 
+      - name: Verify vendored SEO engine
+        run: |
+          set -e
+          CANON_URL="http://gitea.gitea.svc.cluster.local:3000/chemavx/chemavx-seo-tools/raw/branch/main/seo_rules.py"
+          curl -fsS -u "chemavx:${{ secrets.CI_TOKEN }}" "$CANON_URL" -o /tmp/canonical_seo_rules.py
+          N=$(grep -n "BEGIN VENDORED seo_rules.py" src/seo/rules.py | head -1 | cut -d: -f1)
+          tail -n +$((N+1)) src/seo/rules.py > /tmp/vendored_body.py
+          if cmp -s /tmp/canonical_seo_rules.py /tmp/vendored_body.py; then
+            echo "OK: vendored SEO engine matches canonical chemavx-seo-tools/seo_rules.py"
+          else
+            echo "::error::SEO ENGINE DRIFT — src/seo/rules.py != canonical seo_rules.py. Run 'make sync-seo' and commit."
+            diff -u /tmp/canonical_seo_rules.py /tmp/vendored_body.py | head -40 || true
+            exit 1
+          fi
+
       - name: Set image tag
         id: tag
         run: echo "TAG=${GITHUB_SHA::8}" >> $GITHUB_OUTPUT