ci: add a warn-mode lint for tracker tags in source

The hive convention is prose, not tracker tags, in code, but it was
enforced only at review time — three PRs this session needed
request-changes purely for stray tags in new comments.

Add scripts/check-issue-refs.sh: scans tracked source (rust, nix, js,
ts, css, html; markdown exempt) for a hash followed by an issue number
and emits a CI warning annotation per hit. The pattern is a hash, 2-5
digits, then a non-hex char or end-of-line, so it skips CSS hex
colours (letter-bearing or six/eight-digit) while catching tags; a
pure-numeric short hex is the only residual false positive (dodge with
the six-digit form).

Wire it into the CI workflow as a fast pre-check before nix flake
check. It runs in warn mode (exit 0) so it does not block while the
legacy backlog is cleaned up; the script takes a warn|deny arg so the
later flip to a hard gate is a one-word change, not a rewrite — the
same rollout shape as tightening a clippy lint.

.forgejo/workflows/ci.yml

@@ -10,6 +10,13 @@ jobs:
     runs-on: [hive-ci]
     steps:
       - uses: actions/checkout@v3
+      - name: lint tracker tags
+        # Fast pre-check: flags hash-number tracker tags in source
+        # (hive convention is prose, not tags — /knowledge/hive-rules.md).
+        # Phase 1 is warn-only while the legacy backlog is cleaned up;
+        # flip the arg to `deny` for a hard gate once the tree is clean.
+        # See scripts/check-issue-refs.sh.
+        run: sh scripts/check-issue-refs.sh warn
       - name: check
         # Runs all flake checks: formatting (treefmt+rustfmt), cargo test,
         # cargo clippy, and module evaluation. No --no-build: the checks