ci: block merge while a PR contains AI_AGENT_DISCLOSURE.md

The disclosure file added by AI agents states the change may not have
been independently reviewed or tested by its human submitter. It is
meant as a checkpoint, not something to merge: fail a PR check while
the file is present, telling the contributor to review the code their
agent produced and remove the file to confirm that manual review.

Signed-off-by: Nicolas De Loof <[email protected]>

.github/workflows/ai-disclosure-gate.yml

@@ -0,0 +1,25 @@
+name: ai-disclosure-gate
+
+permissions:
+  contents: read
+  pull-requests: read
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    name: AI disclosure gate
+    steps:
+      - name: Block merge while AI_AGENT_DISCLOSURE.md is present
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          files=$(gh api "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" --paginate --jq '.[] | select(.status != "removed") | .filename')
+          if echo "$files" | grep -qE '(^|/)AI_AGENT_DISCLOSURE\.md$'; then
+            echo "::error::This pull request contains AI_AGENT_DISCLOSURE.md, which states the change may not have been independently reviewed or tested by its human submitter. Please review the code your AI agent produced yourself, then remove the file from the commits (amend/rebase) to confirm that manual review took place. The merge stays blocked while the file is present."
+            exit 1
+          fi
+          echo "No AI_AGENT_DISCLOSURE.md in this pull request."