feat(2.4.0): community ad patterns + 49-tag vocabulary + authoritative sponsor seed

.github/labeler.yml

@@ -0,0 +1,2 @@
+pattern:
+  - 'patterns/community/**/*.json'

.github/workflows/labeler.yml

@@ -0,0 +1,23 @@
+name: Auto-label PRs
+
+# pull_request_target runs in the context of the BASE branch and has write
+# access to the PR. The actions/labeler action only reads the file diff and
+# applies labels — no untrusted PR input flows into shell commands here.
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  label:
+    name: Apply path-based labels
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/labeler@v5
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          configuration-path: .github/labeler.yml

.github/workflows/regenerate-manifest.yml

@@ -0,0 +1,74 @@
+name: Regenerate community pattern manifest
+
+# Triggers when a push to main changes anything under patterns/community/
+# (typically a merged PR that added, removed, or updated a pattern file).
+# The workflow rebuilds patterns/community/index.json from the source pattern
+# files and commits the updated manifest back to main.
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'patterns/community/**.json'
+      - '!patterns/community/index.json'  # avoid recursive triggers from our own commits
+
+# Prevent overlapping runs. If two pattern PRs merge back-to-back, the second
+# run waits for the first so the manifest is consistent.
+concurrency:
+  group: regenerate-manifest
+  cancel-in-progress: false
+
+permissions:
+  contents: write  # required to commit the manifest back to main
+
+jobs:
+  regenerate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # Use a PAT or GITHUB_TOKEN that can push back to main.
+          # Default GITHUB_TOKEN works for same-repo pushes that don't trigger
+          # further workflows; if branch protection requires PRs, swap for a
+          # PAT secret.
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+
+      - name: Regenerate manifest
+        run: |
+          python -m src.tools.generate_manifest
+
+      - name: Check for manifest changes
+        id: check
+        run: |
+          if git diff --quiet patterns/community/index.json; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Commit and push updated manifest
+        if: steps.check.outputs.changed == 'true'
+        run: |
+          git config user.name "minuspod-bot"
+          git config user.email "[email protected]"
+          git add patterns/community/index.json
+          git commit -m "chore: regenerate community pattern manifest [skip ci]"
+          git push
+
+      - name: Report no-op
+        if: steps.check.outputs.changed == 'false'
+        run: echo "Manifest already up to date. Nothing to commit."

.github/workflows/validate-community-patterns.yml

@@ -0,0 +1,84 @@
+name: Community Pattern Validation
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - 'patterns/community/**'
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  validate:
+    name: Validate community pattern submissions
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout PR
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
+
+      - name: List changed JSON files under patterns/community/
+        id: changed
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -e
+          changed=$(git diff --diff-filter=AM --name-only "$BASE_SHA" "$HEAD_SHA" \
+            | grep -E '^patterns/community/.+\.json$' \
+            | grep -v 'patterns/community/index.json' \
+            | tr '\n' ' ' || true)
+          echo "files=$changed" >> "$GITHUB_OUTPUT"
+          echo "Changed files: $changed"
+
+      - name: Setup Python
+        if: steps.changed.outputs.files != ''
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.11'
+          cache: pip
+
+      - name: Install lightweight deps
+        if: steps.changed.outputs.files != ''
+        run: |
+          python -m pip install --upgrade pip
+          # The validator imports only stdlib + utils/community_tags, which
+          # itself uses stdlib only. No requirements.txt install required.
+
+      - name: Run validator
+        if: steps.changed.outputs.files != ''
+        id: validate
+        env:
+          CHANGED_FILES: ${{ steps.changed.outputs.files }}
+        run: |
+          set +e
+          python -m src.tools.community_pattern_validator \
+            --pr-files $CHANGED_FILES \
+            --comment-output /tmp/comment.md \
+            --status-output /tmp/status.txt
+          echo "exit=$?" >> "$GITHUB_OUTPUT"
+
+      - name: Post results comment
+        if: always() && steps.changed.outputs.files != ''
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const fs = require('fs');
+            const path = '/tmp/comment.md';
+            if (!fs.existsSync(path)) return;
+            const body = fs.readFileSync(path, 'utf8');
+            await github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body,
+            });
+
+      - name: Fail job on rejection
+        if: steps.changed.outputs.files != '' && steps.validate.outputs.exit != '0'
+        run: |
+          echo "Community pattern validation rejected one or more files."
+          exit 1