docs(P00): create phase plans — v0.16 release binary asset fix

Phase 1 plan: two independent file fixes (single wave).
- Task 1.1 (REQ-183): auth the coreci clone in release.yml
- Task 1.2 (REQ-184): rewrite .coreci.yml to CoreCI native jobs: format
9 must-have verification gates defined.

---ci---
project: orca
phase: 0
milestone: v0.16
status: plan
---/ci---

.ciagent/CHECKPOINT.json

@@ -1,11 +1,11 @@
 {
   "phase": 0,
-  "stage": "research",
+  "stage": "plan",
   "milestone": "v0.16",
   "milestone_slug": "release-binary-fix",
   "phase_role": "pre_execution",
   "attempts": 0,
-  "updated_at": "2026-08-12T21:10:00Z",
+  "updated_at": "2026-08-12T21:15:00Z",
   "milestone_complete": false,
   "previous_milestone": "v0.15",
   "phases_shipped": [],

.ciagent/PLAN_v0.16.md

@@ -0,0 +1,84 @@
+# PLAN v0.16: Release Binary Asset Fix
+
+## Milestone Summary
+
+**Milestone**: v0.16 (fix type — tags on v0.15.x patch line)
+**Phases**: P0 (pre-execution) → P1 (fix) → P2 (final review+ship)
+**Requirements**: REQ-183 (clone auth), REQ-184 (.coreci.yml rewrite)
+
+## Phase 1: Fix Gitea Actions clone auth + rewrite .coreci.yml
+
+### Wave 1: Both fixes (single wave — they are independent files)
+
+**Task 1.1 (REQ-183): Fix `.gitea/workflows/release.yml` — auth the coreci clone**
+
+File: `.gitea/workflows/release.yml`
+
+Current failing step:
+```yaml
+- name: Install CoreCI
+  run: |
+    git clone --depth=1 https://git.cloudinit.dev/coreci/coreci.git /tmp/coreci
+    cd /tmp/coreci
+    CGO_ENABLED=0 go build -tags sqlite_go,embed -o /usr/local/bin/coreci ./cmd/coreci
+    coreci version
+```
+
+Fix: add `GITEA_TOKEN` env and embed in clone URL:
+```yaml
+- name: Install CoreCI
+  env:
+    GITEA_TOKEN: ${{ secrets.PAT_TOKEN }}
+  run: |
+    git clone --depth=1 https://cloudinit-bot:${GITEA_TOKEN}@git.cloudinit.dev/coreci/coreci.git /tmp/coreci
+    cd /tmp/coreci
+    CGO_ENABLED=0 go build -tags sqlite_go,embed -o /usr/local/bin/coreci ./cmd/coreci
+    coreci version
+```
+
+**Task 1.2 (REQ-184): Rewrite `.coreci.yml` to CoreCI native `jobs:` format**
+
+File: `.coreci.yml`
+
+Convert from `pipelines:`/`steps:`/`image:`/`commands:` to `jobs:`/`plugin:`/`invoke:`/`vars:` with a DAG.
+
+DAG structure:
+```
+go-vet ──→ verify-reqs ──┐
+      ├──→ gosec ────────┤
+      ├──→ govulncheck ──┤──→ build ──→ test ──→ release
+      └──→ gitleaks ─────┘
+```
+
+Key adaptations:
+- `plugin: docker://golang:1.25.12` on each job (container if available, shell-isolated fallback)
+- `invoke: |` for multi-line commands (shell expansion works via `sh -c`)
+- `GITEA_TOKEN` via `vars: { GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} }` (resolved from env)
+- `CI_COMMIT_BRANCH` (tag name on tag push) and `CI_COMMIT_SHA` for version injection
+- No tag-conditional rules (workflow gates on `on: push: tags: ['v*']`)
+- `release` job: build tarball + SHA256SUMS, install tea via curl, create release
+  with assets (fallback to Gitea API asset attachment if release exists),
+  verify asset count ≥ 2 (REQ-097 gate C-21)
+- No `apk add` (runner is ubuntu, not alpine)
+
+### Must-haves (verification gates)
+
+- [ ] `.gitea/workflows/release.yml` "Install CoreCI" step has `GITEA_TOKEN` env and token in clone URL
+- [ ] `.coreci.yml` uses `jobs:` top-level key (not `pipelines:`)
+- [ ] Each job has `plugin:` and/or `invoke:` (mutually exclusive rule)
+- [ ] DAG via `needs:` (validate → build → test → release)
+- [ ] `GITEA_TOKEN` passed via job `vars:` with `${{ secrets.GITEA_TOKEN }}`
+- [ ] Release job handles duplicate release (fallback to API asset attachment)
+- [ ] Release job verifies asset count ≥ 2 (REQ-097)
+- [ ] No `apk add` commands (ubuntu runner, not alpine)
+- [ ] No `${VAR}` interpolation in YAML fields (only in `invoke:` via sh -c)
+- [ ] `make verify-reqs` passes (ROADMAP ↔ REQUIREMENTS consistency)
+
+### Verification
+
+1. `make verify-reqs` — ROADMAP/REQUIREMENTS consistency
+2. `go vet ./...` — no vet errors
+3. `gofmt -l .` — no formatting issues
+4. YAML validity check for `.coreci.yml` and `.gitea/workflows/release.yml`
+5. Confirm `.coreci.yml` has `jobs:` key and at least 5 jobs (go-vet, verify-reqs, gosec, govulncheck, gitleaks, build, test, release)
+6. Confirm `.gitea/workflows/release.yml` "Install CoreCI" step references `GITEA_TOKEN`