ci: make the tracker-tag lint its own non-blocking check

Per operator guidance: the required-status-checks config gates merge
on the nix flake check only, not this lint. So drop the warn|deny
mode — the lint just fails (exit 1, error annotations) when it finds
tracker tags, and runs as its own CI job so that failure shows red on
the PR without failing the required nix flake check job or blocking
merge. Once the legacy backlog is cleaned up, promoting this job to a
required check flips it to a hard gate — no code change.

.forgejo/workflows/ci.yml

@@ -10,15 +10,22 @@ jobs:
     runs-on: [hive-ci]
     steps:
       - uses: actions/checkout@v3
-      - name: lint tracker tags
-        # Fast pre-check: flags hash-number tracker tags in source
-        # (hive convention is prose, not tags — /knowledge/hive-rules.md).
-        # Phase 1 is warn-only while the legacy backlog is cleaned up;
-        # flip the arg to `deny` for a hard gate once the tree is clean.
-        # See scripts/check-issue-refs.sh.
-        run: sh scripts/check-issue-refs.sh warn
       - name: check
         # Runs all flake checks: formatting (treefmt+rustfmt), cargo test,
         # cargo clippy, and module evaluation. No --no-build: the checks
         # derivations are the canonical source of truth.
         run: nix flake check
+
+  tracker-tags:
+    name: tracker-tag lint
+    runs-on: [hive-ci]
+    steps:
+      - uses: actions/checkout@v3
+      - name: lint
+        # Flags hash-number tracker tags in source (hive convention is
+        # prose, not tags — /knowledge/hive-rules.md). Runs as its own
+        # job, kept out of the required checks while the legacy backlog
+        # is cleaned up: a hit fails this check (red) without blocking
+        # merge. Promote to a required check once the tree is clean.
+        # See scripts/check-issue-refs.sh.
+        run: sh scripts/check-issue-refs.sh