ci(OMN-14104): gate CI fanout behind OCC preflight

.github/workflows/artifact-reconciliation-webhook.yml

@@ -22,7 +22,19 @@ on:
     types: [opened, synchronize, closed, reopened]
 
 jobs:
+  occ-preflight:
+    # self-gating-ok: centralized OCC preflight reusable is the canonical cross-repo gate for non-OCC repositories.
+    uses: OmniNode-ai/omnibase_core/.github/workflows/occ-preflight.yml@8a47e092002dd1338599fa0733feda469436acbf
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      contracts-dir: contracts
+      receipts-dir: drift/dod_receipts
+      core-ref: 8a47e092002dd1338599fa0733feda469436acbf
+
   publish-pr-webhook:
+    needs: occ-preflight
     name: Publish PR Webhook Event
     runs-on: >-
       ${{

.github/workflows/auto-merge.yml

@@ -47,7 +47,19 @@ permissions:
   pull-requests: write
 
 jobs:
+  occ-preflight:
+    # self-gating-ok: centralized OCC preflight reusable is the canonical cross-repo gate for non-OCC repositories.
+    uses: OmniNode-ai/omnibase_core/.github/workflows/occ-preflight.yml@8a47e092002dd1338599fa0733feda469436acbf
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      contracts-dir: contracts
+      receipts-dir: drift/dod_receipts
+      core-ref: 8a47e092002dd1338599fa0733feda469436acbf
+
   auto-merge:
+    needs: occ-preflight
     timeout-minutes: 30
     name: Enable Auto-Merge
     runs-on: >-

.github/workflows/call-occ-preflight.yml

@@ -36,7 +36,9 @@ permissions:
 
 jobs:
   occ-preflight:
-    uses: OmniNode-ai/omnibase_core/.github/workflows/occ-preflight.yml@main
+    # self-gating-ok: centralized OCC preflight reusable is the canonical cross-repo gate for non-OCC repositories.
+    uses: OmniNode-ai/omnibase_core/.github/workflows/occ-preflight.yml@8a47e092002dd1338599fa0733feda469436acbf
     with:
       contracts-dir: contracts
       receipts-dir: drift/dod_receipts
+      core-ref: 8a47e092002dd1338599fa0733feda469436acbf

.github/workflows/call-receipt-gate.yml

@@ -34,7 +34,19 @@ permissions:
   pull-requests: read
 
 jobs:
+  occ-preflight:
+    # self-gating-ok: centralized OCC preflight reusable is the canonical cross-repo gate for non-OCC repositories.
+    uses: OmniNode-ai/omnibase_core/.github/workflows/occ-preflight.yml@8a47e092002dd1338599fa0733feda469436acbf
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      contracts-dir: contracts
+      receipts-dir: drift/dod_receipts
+      core-ref: 8a47e092002dd1338599fa0733feda469436acbf
+
   verify:
+    needs: occ-preflight
     uses: OmniNode-ai/omnibase_core/.github/workflows/receipt-gate.yml@main
     with:
       branch-policy-mode: >-

.github/workflows/call-reject-skip.yml

@@ -29,6 +29,18 @@ permissions:
   pull-requests: read
 
 jobs:
+  occ-preflight:
+    # self-gating-ok: centralized OCC preflight reusable is the canonical cross-repo gate for non-OCC repositories.
+    uses: OmniNode-ai/omnibase_core/.github/workflows/occ-preflight.yml@8a47e092002dd1338599fa0733feda469436acbf
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      contracts-dir: contracts
+      receipts-dir: drift/dod_receipts
+      core-ref: 8a47e092002dd1338599fa0733feda469436acbf
+
   call-reject-skip-token:
+    needs: occ-preflight
     uses: OmniNode-ai/omniclaude/.github/workflows/reject-deploy-gate-skip.yml@main
     secrets: inherit

.github/workflows/canonical-inference-gate.yml

@@ -47,7 +47,19 @@ permissions:
   contents: read
 
 jobs:
+  occ-preflight:
+    # self-gating-ok: centralized OCC preflight reusable is the canonical cross-repo gate for non-OCC repositories.
+    uses: OmniNode-ai/omnibase_core/.github/workflows/occ-preflight.yml@8a47e092002dd1338599fa0733feda469436acbf
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      contracts-dir: contracts
+      receipts-dir: drift/dod_receipts
+      core-ref: 8a47e092002dd1338599fa0733feda469436acbf
+
   canonical-inference-gate:
+    needs: occ-preflight
     timeout-minutes: 30
     name: Canonical Inference Gate
     # OMNI_RUNNER_SELECTOR_V1 - trusted CI defaults to self-hosted omnibase-ci; public forks default to ubuntu-latest.

.github/workflows/check-handshake.yml

@@ -15,7 +15,19 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  occ-preflight:
+    # self-gating-ok: centralized OCC preflight reusable is the canonical cross-repo gate for non-OCC repositories.
+    uses: OmniNode-ai/omnibase_core/.github/workflows/occ-preflight.yml@8a47e092002dd1338599fa0733feda469436acbf
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      contracts-dir: contracts
+      receipts-dir: drift/dod_receipts
+      core-ref: 8a47e092002dd1338599fa0733feda469436acbf
+
   check-handshake:
+    needs: occ-preflight
     name: Check architecture handshake
     # OMNI_RUNNER_SELECTOR_V1 — trusted CI defaults to self-hosted omnibase-ci; public forks default to ubuntu-latest
     runs-on: >-

.github/workflows/check-sibling-compat.yml

@@ -23,7 +23,19 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  occ-preflight:
+    # self-gating-ok: centralized OCC preflight reusable is the canonical cross-repo gate for non-OCC repositories.
+    uses: OmniNode-ai/omnibase_core/.github/workflows/occ-preflight.yml@8a47e092002dd1338599fa0733feda469436acbf
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      contracts-dir: contracts
+      receipts-dir: drift/dod_receipts
+      core-ref: 8a47e092002dd1338599fa0733feda469436acbf
+
   sibling-compat:
+    needs: occ-preflight
     name: Sibling Compat Check (OMN-4315)
     runs-on: >-
       ${{