ci: pin the checks image to v0.13.0, stamp the repo's own config, plans, and tools, and validate them in that image

[tylerdavis]

The follow-up deferred from #121 and #122 now that v0.13.0 exists. Three things that have to move together, in one PR:

• The checks image pin in graph-checks.yaml moves from v0.12.0 to v0.13.0 on all three jobs. v0.12.0 rejects a top-level version key as an unknown field, so the stamp below could not land before this.
• This repo's own .graph/ files are stamped: version = 1 in .graph/config.toml (after its header comment), version: 1 as the first key of every plan and tool document. Inserted textually so every comment stays where it was; graph's own migrate commands would have dropped the interior comments in gh_pr_thread_sync.yaml, review_graph_pr.yaml, and graph_review_thread_audit.yaml.
• A dogfood-files job runs graph version, graph config check, and graph plan validate over every .graph/plans/*.yaml inside the pinned image, with no model calls. Plans and config load from the PR checkout while the engine comes from the image, so a future file-version bump the image cannot read fails this job until the pin moves in the same PR. Same guards as the other jobs (not draft, same repo) since it pulls the private image.

CLAUDE.md mentions the new job. Ships to nobody, so ci:.

Verification

With a 0.13.0 debug build of this branch, GRAPH_STORAGE=memory: graph version reports all four file versions at 1; graph config check reports ./.graph/config.toml as version 1 current; graph plan validate passes for all seven plans; graph tools list --json loads all 12 user tools. The format-drift gate on this PR will short-circuit (no crate files changed), and the new job runs on the PR itself.

[graph-graph]

Note

graph_review_9000 · Small, tightly-scoped CI change: pins the checks image to v0.13.0, stamps version:1 across the repo's own .graph/ config/plan/tool files, adds a dogfood-files validation job, and documents it in CLAUDE.md.

At a glance

Pass	Area	Status
1	Stated Intent	✅ Pass
2	Pipeline/Control-Step Invariants	⚪ N/A
3	Template/Shape Engine	⚪ N/A
4	Rust/Async/Storage Footguns	⚪ N/A
5	Plan Composition/Model Routing	⚪ N/A
6	Test Coverage	🟡 Unverified / Intentional
7	Repo Conventions/Docs Parity	✅ Pass
8	CLI Surface/Copy	✅ Pass

🧵 0 new · 0 open · 0 resolved this run · 0 declined

🟡 Needs verification / intentional (1)

Test Coverage — No workspace tests exist for CI workflow YAML or .graph/ file stamps; verification is described as manual (author ran the built binary against the branch) rather than an automated test, which is normal for this kind of change but not independently confirmable here.

⚪ N/A · ✅ Pass

Stated Intent — Diff matches the description: image pin moved to v0.13.0 on all jobs, version stamps added textually (comments preserved), new dogfood-files job added, CLAUDE.md updated.

Pipeline/Control-Step Invariants — Diff touches only YAML config/CI files, not pipeline/control-step code.

Template/Shape Engine — No template or shape-engine code touched.

Rust/Async/Storage Footguns — No Rust source changed; this is purely CI/config/YAML.

Plan Composition/Model Routing — Plan files only gain a version key; no composition, routing, or step logic changed.

Repo Conventions/Docs Parity — CLAUDE.md was updated in the same PR to describe the new dogfood-files job, satisfying the docs-parity invariant for this CI-facing change.

CLI Surface/Copy — New dogfood-files job only runs graph version/config check/plan validate for CI diagnostics; no new user-facing CLI copy or exit-code changes are introduced.