harness: scratch graduation pipeline (push side + spec) + flarum first test case

- graduation-push.sh: tar+scp scratch -> BEAST graduation-inbox over Tailscale (decoupled
  from /save, soft-fail if BEAST off). Tested: 241 files -> BEAST.
- docs/graduation-pipeline.md: full spec (push -> Ollama triage on BEAST GPU via API ->
  reviewed sanitize+git-mv). Secrets never enter git; ride the encrypted link to BEAST only.
- tmp-promotion-check.sh: rewritten pure-builtin (0.4s) after the per-file grep/fork loop
  hung /save for 4 min on Windows at ~240 scratch files. Deep triage moves to the pipeline.
- forum-post: GRADUATED the canonical flarum poster from scratch ->
  skills/forum-post/scripts/flarum-post.py (s9e markdown->XML + DB insert machinery), with
  the hardcoded IX SSH + Flarum DB passwords swapped to vault lookups. First pipeline test case.
- Vaulted the Flarum DB cred (services/flarum-community.sops.yaml) + sanitized the two
  plaintext copies in forum-post.md.
- errorlog: logged the WSL-stub correction + BEAST-Ollama-CPU(vram=0) finding + the
  promotion-check hang, all via the new log helper.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/scripts/tmp-promotion-check.sh

@@ -27,40 +27,17 @@ mapfile -t FILES < <(
 echo "[INFO] Promotion check: ${#FILES[@]} file(s) in scratch dirs (gitignored — NOT committed)."
 echo "       Graduate anything worth keeping before it's lost. Guide: .claude/TEMP_GRADUATION.md"
 
+# PURE-BUILTIN loop (no per-file subprocesses) — `basename`/`wc` forks ×N hung this for
+# 20s+ on Windows Git-bash at ~240 scratch files (fork is expensive). Flag scripts by
+# extension only; deep triage (doc size, "is it referenced", what's it for) is deferred to
+# the async Ollama graduation pass (see TEMP_GRADUATION.md). Keep this O(N) and fork-free.
 candidates=0
 for f in "${FILES[@]}"; do
-  base="$(basename "$f")"
-  reason=""
-
-  # Script-like files: reusable automation worth a permanent home.
-  case "$base" in
-    *.py|*.sh|*.ps1|*.psm1|*.js|*.rb|*.pl) reason="script" ;;
+  case "${f##*/}" in
+    *.py|*.sh|*.ps1|*.psm1|*.js|*.rb|*.pl|*.php)
+      echo "       [GRADUATE?] $f  (script)"
+      candidates=$((candidates + 1)) ;;
   esac
-
-  # Substantial docs (audit reports, dossiers) — size threshold ~4 KB.
-  if [ -z "$reason" ]; then
-    case "$base" in
-      *.md|*.csv)
-        sz=$(wc -c < "$f" 2>/dev/null || echo 0)
-        [ "${sz:-0}" -ge 4096 ] && reason="doc ($((sz/1024))KB)"
-        ;;
-    esac
-  fi
-
-  # Referenced in a session log / doc → clearly load-bearing.
-  # Scope to markdown only and skip heavy build/dep/vcs trees — a bare `grep -r`
-  # over projects/ (Rust target/, node_modules/, .git) hangs for minutes per file.
-  if grep -rqlF "$f" --include='*.md' \
-       --exclude-dir=.git --exclude-dir=node_modules --exclude-dir=target \
-       --exclude-dir=dist --exclude-dir=build --exclude-dir=.next --exclude-dir=vendor \
-       session-logs/ clients/ projects/ 2>/dev/null; then
-    reason="${reason:+$reason, }referenced"
-  fi
-
-  if [ -n "$reason" ]; then
-    echo "       [GRADUATE?] $f  ($reason)"
-    candidates=$((candidates + 1))
-  fi
 done
 
 if [ "$candidates" -eq 0 ]; then