ci(process): #311 H11 rebase-before-push hook + PR-scoped format-verify CI job

- H11: .husky/pre-push calls .claude/hooks/prepush-rebase-check.sh, which blocks a
  push whose branch is behind origin/main (rebase first; do not merge main in — a
  merge drags in files you didn't touch, e.g. legacy-BOM .cs, tripping the format
  hook on code that isn't yours). Fail-open; escape ETV_SKIP_REBASE_CHECK=1.
- New blocking `format` CI job: dotnet format --verify-no-changes scoped to the
  PR's changed .cs only (style + charset=utf-8/no-BOM), enforcing fix-as-you-touch
  without a big-bang reformat of the ~2500 legacy BOM files. .cs-free PRs skip and
  pass (always reports a status). Closes the "CI never checks charset" gap that let
  #269 land 17 BOM files (#310).

Docs (contributing.md §7 / decisions.md / lore) follow in the next commit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/docker-build.yml

@@ -478,3 +478,64 @@ jobs:
             exit 1
           fi
           echo "Generated API artifacts are in sync."
+
+  # Formatting-as-you-touch gate (ersatztv#311): verify the .cs files THIS PR changed conform to
+  # .editorconfig (style + charset=utf-8, i.e. no UTF-8 BOM). Scoped to changed files so it enforces
+  # "normalize a legacy file when you touch it" WITHOUT a big-bang reformat of the ~2500 pre-existing
+  # BOM files. A PR that touches no .cs skips the expensive steps and passes trivially (always reports
+  # a status, so it is safe as a required check).
+  format:
+    name: Formatting (changed .cs conform to .editorconfig)
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Detect changed C# files
+        id: detect
+        run: |
+          base_ref="${{ github.base_ref }}"
+          git fetch --no-tags --depth=100 origin "$base_ref" || true
+          changed="$(git diff --name-only --diff-filter=ACM "origin/${base_ref}...HEAD" -- '*.cs' 2>/dev/null || true)"
+          echo "Changed .cs files in this PR:"; printf '%s\n' "$changed"
+          if [ -n "$changed" ]; then
+            printf '%s\n' "$changed" > /tmp/changed-cs.txt
+            echo "cs_changed=true" >> "$GITHUB_OUTPUT"
+            echo "-> will verify these files conform to .editorconfig."
+          else
+            echo "cs_changed=false" >> "$GITHUB_OUTPUT"
+            echo "No .cs change -> skipping format verify (job passes)."
+          fi
+
+      - name: Setup .NET
+        if: steps.detect.outputs.cs_changed == 'true'
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Cache NuGet packages
+        if: steps.detect.outputs.cs_changed == 'true'
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('Directory.Packages.props', 'global.json') }}
+          restore-keys: nuget-${{ runner.os }}-
+
+      - name: Restore
+        if: steps.detect.outputs.cs_changed == 'true'
+        run: dotnet restore
+
+      - name: Verify formatting of changed .cs files
+        if: steps.detect.outputs.cs_changed == 'true'
+        shell: bash
+        run: |
+          mapfile -t files < /tmp/changed-cs.txt
+          echo "Verifying ${#files[@]} changed .cs file(s) against .editorconfig..."
+          if ! dotnet format ErsatzTV.sln --no-restore --verify-no-changes --include "${files[@]}"; then
+            echo "::error::One or more .cs files this PR touches don't conform to .editorconfig (formatting or a UTF-8 BOM). Run 'dotnet format ErsatzTV.sln --include <files>' and commit the result in THIS PR — the fix-as-you-touch convention (docs/contributing.md §7; ersatztv#311). Legacy files you did NOT touch are unaffected."
+            exit 1
+          fi
+          echo "All changed .cs files conform to .editorconfig."