feat(P01): reusable pipeline workflow skeleton (T-2.2)

---ci---
phase: 1
milestone: v1.0
status: execute
persona: backend-engineer
task: T-2.2
requirements:
  covered: [REQ-10]
---/ci---

Wave 2, task T-2.2. .gitea/workflows/pipeline.yml is the reusable pipeline
skeleton (on: workflow_call) with 4 jobs: dev, qa-gate, prod-gate, finalize.
Branch-pin rule documented in the header comment (uses @milestone/v1.0-initial).
All step bodies are explicit placeholders marked 'Phase 04 will implement'.
Phase 04 will replace the placeholders with the real Dev logic and the
workflow_dispatch approval inputs (D-013; Gitea ignores environment: blocks).

.gitea/workflows/pipeline.yml

@@ -0,0 +1,75 @@
+# ACDL reusable pipeline workflow (Phase 01 skeleton).
+#
+# This workflow is called from acdl-contracts via:
+#   uses: continuous-intelligence/acdl/.gitea/workflows/pipeline.yml@milestone/v1.0-initial
+#
+# Branch pinning rule (see .ciagent/ARCHITECTURE.md): the `acdl` repo's default
+# branch is `milestone/v1.0-initial`, so `uses:` references must pin to
+# `@milestone/v1.0-initial`, NOT `@main`.
+#
+# Phase 04 will implement the actual stage logic + approval gates (D-013:
+# Gitea has no environments API; gates become workflow_dispatch approval
+# inputs).
+name: acdl-pipeline
+
+on:
+  workflow_call:
+    inputs:
+      contract-ref:
+        description: "Ref on acdl-contracts that triggered the pipeline"
+        required: false
+        type: string
+        default: main
+
+jobs:
+  dev:
+    name: "Dev (autonomous)"
+    runs-on: ubuntu-latest
+    steps:
+      # Phase 04 will implement: checkout acdl + acdl-contracts, run
+      # policy_checker.py, mock_executor.sh, confidence_signal.py, write
+      # evidence via evidence_writer.py.
+      - name: "Dev stage placeholder"
+        run: |
+          echo "Dev stage placeholder (Phase 01 skeleton)"
+          echo "Phase 04 will run policy_checker, mock_executor, confidence_signal, evidence_writer"
+          exit 0
+
+  qa-gate:
+    name: "QA (manual approval)"
+    needs: dev
+    runs-on: ubuntu-latest
+    steps:
+      # Phase 04 will implement: gate via workflow_dispatch approval input
+      # (D-013 fallback; Gitea ignores jobs.<id>.environment).
+      - name: "QA gate placeholder"
+        run: |
+          echo "QA gate placeholder (Phase 01 skeleton)"
+          echo "Phase 04 will pause here for human approval via workflow_dispatch"
+          exit 0
+
+  prod-gate:
+    name: "Prod (manual approval)"
+    needs: qa-gate
+    runs-on: ubuntu-latest
+    steps:
+      # Phase 04 will implement: same approval-input gate as qa-gate.
+      - name: "Prod gate placeholder"
+        run: |
+          echo "Prod gate placeholder (Phase 01 skeleton)"
+          echo "Phase 04 will pause here for human approval via workflow_dispatch"
+          exit 0
+
+  finalize:
+    name: "Finalize (publish evidence)"
+    needs: prod-gate
+    runs-on: ubuntu-latest
+    steps:
+      # Phase 04/05 will implement: commit audit.json to acdl-evidence main
+      # via the Gitea file-contents API; raw URL republishes index.html +
+      # audit.json for the timeline UI (D-012).
+      - name: "Finalize placeholder"
+        run: |
+          echo "Finalize placeholder (Phase 01 skeleton)"
+          echo "Phase 04/05 will commit audit.json to acdl-evidence main"
+          exit 0