[fork] Make upstream alignment a load-bearing, enforced fork goal

[Mazyod]

Stacked on #6 — base retargets to main once that merges. Kept separate because folding it into the version bump would break the very "one change, one goal" rule it introduces.

Why

The fork exists to carry a handful of upstream fixes, not to become a divergent vLLM. That was a convention held up by good intentions. This makes it a rule the repo enforces.

The charter (FORK.md § Charter)

• R1 — Additive only, plus a declared deletion list. The fork never modifies an upstream-owned file in-tree. Content changes ride as patches applied to the image.
• R2 — One patch, one concrete goal, traceable upstream. One upstream PR, smallest diff that achieves it, note required.
• R3 — Every divergence carries an exit criterion. Patches record the upstream commit that retires them; deletions record why they're permanent.
• Standing obligation: each release, first drop what upstream absorbed, then rebase what it didn't. The series should shrink by default.

How it's enforced

fork/alignment.ledger declares the entire divergence surface — 4 added paths, 6 deleted upstream workflows, each with rationale and lifetime.

fork/scripts/check-alignment.sh diffs HEAD against the merge-base with upstream/main (so unmerged upstream commits are never mistaken for fork changes) and fails on anything undeclared:

  added     15 files, declared                                   OK
  deleted   6 files, declared                                    OK
  modified  0 upstream files                                     OK

Runs on every PR (fork-alignment.yml) and as a needs: gate on build-and-push, so a drifted fork can neither merge nor ship.

Test results

Six cases, each run against a scratch worktree:

#	Case	Expected	Result
1	clean tree	pass	pass (exit 0)
2	edit vllm/v1/core/sched/scheduler.py in-tree	fail	fail — modified ... FORBIDDEN
3	add undeclared tools/mine/helper.py	fail	fail — added ... UNDECLARED
4	delete a declared workflow	pass	pass (exit 0)
5	upstream merge resurrects stale.yml	fail	fail — resurrected ... DECLARED DELETED
6	ledger declares a file upstream no longer ships	warn, pass	warn + exit 0

Case 5 was added mid-review: the first version only warned when a declared-deleted workflow came back, while FORK.md claimed it failed. A half-finished sync silently restoring the stale bot is exactly the drift this should catch, so the code was changed to match the claim — resurrection now fails, while a genuinely obsolete ledger entry still only warns.

Also verified: both workflow files parse as YAML; the job graph is build-and-push: needs: [alignment, resolve]; actions/checkout@v5 does support the filter: input used for the blobless clone.

AI assistance was used for this change (Claude Code).