ci: auto-bump beardrive-cloud OSS pin on merge; pre-PR diagram hook (#42)

* tooling: pre-PR hook keeps architecture/ diagrams honest

PreToolUse(Bash) hook blocks gh pr create when internal/webapp or
internal/remote changed but architecture/ didn't; CLAUDE.md documents the
rule and the '# skip-diagram-check' escape hatch for non-structural changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci: bump beardrive-cloud's OSS pin on every merge to main

Each OSS main push commits the new sha to OSS_COMMIT in
runbear-io/beardrive-cloud (CLOUD_BUMP_TOKEN: fine-grained PAT, that repo
only, contents r/w — already set). The bump push runs cloud CI against the
new pin and, only if green, the prod deploy — closing the OSS half of the
CI/CD loop. Rebase-retry loop absorbs racing merges.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/bump-cloud.yml

@@ -0,0 +1,49 @@
+# Every OSS merge to main bumps OSS_COMMIT in runbear-io/beardrive-cloud.
+# That push triggers cloud CI: full test suite against the new pin, then the
+# prod deploy — a bad combo fails cloud CI and never deploys.
+# Needs the CLOUD_BUMP_TOKEN secret: fine-grained PAT, beardrive-cloud repo
+# only, Contents read+write.
+name: bump-cloud
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: bump-cloud
+  cancel-in-progress: false
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout beardrive-cloud
+        uses: actions/checkout@v4
+        with:
+          repository: runbear-io/beardrive-cloud
+          token: ${{ secrets.CLOUD_BUMP_TOKEN }}
+
+      - name: Bump OSS_COMMIT and push
+        env:
+          OSS_SHA: ${{ github.sha }}
+          # Via env, not inline interpolation: commit messages are attacker-
+          # controlled text and must never be spliced into the script itself.
+          HEAD_MSG: ${{ github.event.head_commit.message }}
+        run: |
+          if [ "$(cat OSS_COMMIT)" = "$OSS_SHA" ]; then
+            echo "already pinned at $OSS_SHA"
+            exit 0
+          fi
+          printf '%s\n' "$OSS_SHA" > OSS_COMMIT
+          git config user.name "beardrive-bot"
+          git config user.email "bot@beardrive.ai"
+          git add OSS_COMMIT
+          subject="$(printf '%s' "${HEAD_MSG:-manual bump}" | head -n1)"
+          git commit -m "bump OSS to ${OSS_SHA::7}: ${subject}"
+          # Two quick OSS merges can race; rebase keeps both bumps (last wins
+          # on the pin, which is correct — it's the newer OSS commit).
+          for i in 1 2 3; do
+            git push && exit 0
+            git pull --rebase
+          done
+          exit 1