CUST-WP-0050 follow-up: human review, push tooling, SSH inventory

Add human-review script for 13 high-blast-radius repos, bulk-push helper,
and SSH-based Gitea inventory probe. Update exclusion list with SSH-verified
absent slugs; marki-docx now classified and registered.

tools/gitea_ssh_inventory.py

@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+"""Compare State Hub registered repos against Gitea SSH reachability (no HTTP token)."""
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+import urllib.request
+
+API_BASE = "http://127.0.0.1:8000"
+GITEA_REMOTE = "gitea-remote"
+
+
+def hub_repos() -> list[dict]:
+    with urllib.request.urlopen(f"{API_BASE}/repos/", timeout=30) as resp:
+        return json.load(resp)
+
+
+def gitea_exists(path: str) -> bool:
+    proc = subprocess.run(
+        [
+            "git",
+            "ls-remote",
+            f"{GITEA_REMOTE}:{path}.git",
+            "HEAD",
+        ],
+        capture_output=True,
+        text=True,
+        env={**__import__("os").environ, "GIT_SSH_COMMAND": "ssh -o ConnectTimeout=8 -o BatchMode=yes"},
+    )
+    return proc.returncode == 0 and any(line.strip() for line in proc.stdout.splitlines())
+
+
+def main() -> int:
+    repos = hub_repos()
+    active = [r for r in repos if r.get("status") == "active"]
+    matched: list[str] = []
+    missing: list[str] = []
+
+    for repo in sorted(active, key=lambda r: r["slug"]):
+        slug = repo["slug"]
+        if gitea_exists(f"coulomb/{slug}"):
+            matched.append(slug)
+        else:
+            missing.append(slug)
+
+    print(f"State Hub active repos: {len(active)}")
+    print(f"Gitea SSH reachable (coulomb/<slug>): {len(matched)}")
+    print(f"Hub-only (no coulomb/<slug> on Gitea SSH): {len(missing)}")
+    if missing:
+        print("\nMissing on Gitea:")
+        for slug in missing:
+            print(f"  - {slug}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())