docs: add README badges and reusable-workflow call-graph diagram (#29)

## Summary

- Adds a two-badge row to `README.md` (Repo CI workflow status, License
MIT), matching the `packer-framework-template` badge style
(`[![CI](…)](…)` then `[![License: MIT](…)](LICENSE)`).
- Adds the first Mermaid diagram to this repo:
`docs/diagrams/reusable-workflow-call-graph.mmd` — a flowchart showing a
consumer repo calling all seven universal reusables by SHA, with the
drift-gate relationship between `reusable-repo-hygiene` ↔
`baseline-manifest.json` and `reusable-org-adr-auto-sync` ↔
`org-adr-manifest.json`.
- Embeds the diagram inline in
`docs/explanation/repo-type-taxonomy-and-ci-focus.md` with a source link
per `docs/reference/diagram-conventions.md`.
- Allowlists `docs/diagrams/reusable-workflow-call-graph.mmd` in
`.gitignore` (deny-all strategy requires explicit per-file entries).

## Ruleset note (no change in this PR)

The "Default Branch Protection" ruleset on this repo is currently active
but empty — no rules are configured inside it. It is vestigial and
should be removed via terraform in a follow-on infrastructure change.
This PR does not touch rulesets.

## Validation

- `python tools/check_docs_layout.py` — passes
- `python tools/check_adr_schema.py` — passes
- `python tools/check_baseline_manifest.py` — passes
- `npx markdownlint-cli2 "**/*.md"` — 0 errors
- `git status --short` after staging — all 4 changed files tracked (none
ignored)
present

## Test plan

- [ ] Repo CI workflow passes (actionlint, markdownlint, docs-layout,
adr-schema, baseline-manifest, attribution-residue, smoke tests)
- [ ] README badges render correctly on the repo landing page
- [ ] Mermaid diagram renders in
`docs/explanation/repo-type-taxonomy-and-ci-focus.md` on GitHub

Author: NWarila

.gitignore

@@ -113,6 +113,7 @@
 !/docs/explanation/repo-type-taxonomy-and-ci-focus.md
 !/docs/diagrams/
 !/docs/diagrams/.gitkeep
+!/docs/diagrams/reusable-workflow-call-graph.mmd
 !/docs/runbooks/
 !/docs/runbooks/.gitkeep
 !/docs/runbooks/purge-ai-attributed-history.md

README.md

@@ -1,5 +1,8 @@
 # .github
 
+[![Repo CI](https://github.com/NWarila/.github/actions/workflows/repo-ci.yml/badge.svg)](https://github.com/NWarila/.github/actions/workflows/repo-ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
 Default GitHub metadata for repositories owned by
 [NWarila](https://github.com/NWarila).
 

docs/diagrams/reusable-workflow-call-graph.mmd

@@ -0,0 +1,28 @@
+flowchart TD
+    Consumer["Consumer repo\n(caller workflow)"]
+
+    subgraph NWarila_github ["NWarila/.github — pinned by SHA"]
+        codeql["reusable-codeql.yaml"]
+        iac["reusable-iac-security.yaml"]
+        scorecard["reusable-scorecard.yaml"]
+        release["reusable-release-please.yaml"]
+        automerge["reusable-auto-merge.yaml"]
+        hygiene["reusable-repo-hygiene.yaml"]
+        adrsync["reusable-org-adr-auto-sync.yaml"]
+    end
+
+    subgraph Drift_gates ["Drift-gate artefacts (NWarila/.github)"]
+        baseline["baseline-manifest.json\n(byte-identical file list)"]
+        adrmanifest["org-adr-manifest.json\n(ADR source-of-truth list)"]
+    end
+
+    Consumer -->|"uses: NWarila/.github/.github/workflows/reusable-codeql.yaml@SHA"| codeql
+    Consumer -->|"uses: NWarila/.github/.github/workflows/reusable-iac-security.yaml@SHA"| iac
+    Consumer -->|"uses: NWarila/.github/.github/workflows/reusable-scorecard.yaml@SHA"| scorecard
+    Consumer -->|"uses: NWarila/.github/.github/workflows/reusable-release-please.yaml@SHA"| release
+    Consumer -->|"uses: NWarila/.github/.github/workflows/reusable-auto-merge.yaml@SHA"| automerge
+    Consumer -->|"uses: NWarila/.github/.github/workflows/reusable-repo-hygiene.yaml@SHA"| hygiene
+    Consumer -->|"uses: NWarila/.github/.github/workflows/reusable-org-adr-auto-sync.yaml@SHA"| adrsync
+
+    hygiene -->|"fetches + evaluates"| baseline
+    adrsync -->|"reads manifest to detect drift"| adrmanifest

docs/explanation/repo-type-taxonomy-and-ci-focus.md

@@ -56,6 +56,46 @@ CI focus:
 - Does repo-hygiene pass against the control plane itself?
 - Is public source-control hygiene clean?
 
+## Reusable-Workflow Call Graph
+
+The diagram below shows how a consumer repo calls the seven universal reusables
+hosted in `NWarila/.github`, and how the drift-gate artefacts (`baseline-manifest.json`
+and `org-adr-manifest.json`) relate to `reusable-repo-hygiene` and
+`reusable-org-adr-auto-sync`.
+
+Source: [docs/diagrams/reusable-workflow-call-graph.mmd](../diagrams/reusable-workflow-call-graph.mmd)
+
+```mermaid
+flowchart TD
+    Consumer["Consumer repo\n(caller workflow)"]
+
+    subgraph NWarila_github ["NWarila/.github — pinned by SHA"]
+        codeql["reusable-codeql.yaml"]
+        iac["reusable-iac-security.yaml"]
+        scorecard["reusable-scorecard.yaml"]
+        release["reusable-release-please.yaml"]
+        automerge["reusable-auto-merge.yaml"]
+        hygiene["reusable-repo-hygiene.yaml"]
+        adrsync["reusable-org-adr-auto-sync.yaml"]
+    end
+
+    subgraph Drift_gates ["Drift-gate artefacts (NWarila/.github)"]
+        baseline["baseline-manifest.json\n(byte-identical file list)"]
+        adrmanifest["org-adr-manifest.json\n(ADR source-of-truth list)"]
+    end
+
+    Consumer -->|"uses: NWarila/.github/.github/workflows/reusable-codeql.yaml@SHA"| codeql
+    Consumer -->|"uses: NWarila/.github/.github/workflows/reusable-iac-security.yaml@SHA"| iac
+    Consumer -->|"uses: NWarila/.github/.github/workflows/reusable-scorecard.yaml@SHA"| scorecard
+    Consumer -->|"uses: NWarila/.github/.github/workflows/reusable-release-please.yaml@SHA"| release
+    Consumer -->|"uses: NWarila/.github/.github/workflows/reusable-auto-merge.yaml@SHA"| automerge
+    Consumer -->|"uses: NWarila/.github/.github/workflows/reusable-repo-hygiene.yaml@SHA"| hygiene
+    Consumer -->|"uses: NWarila/.github/.github/workflows/reusable-org-adr-auto-sync.yaml@SHA"| adrsync
+
+    hygiene -->|"fetches + evaluates"| baseline
+    adrsync -->|"reads manifest to detect drift"| adrmanifest
+```
+
 ## Practical Consequence
 
 The same governance doctrine can produce different visible file shapes. A framework template may enforce repo hygiene through `make ci`; a data-only runner may use a standalone caller. A control plane may own reusable workflow bodies; a consumer may only own thin callers. That variation is intentional when it follows repository responsibility.