refactor(factory): replace Pi pipeline with Kit

.dockerignore

@@ -0,0 +1,10 @@
+.git
+**/.git
+.worktrees
+.claude/worktrees
+.env
+.env.*
+mise.local.toml
+pulse-catalog.json
+tools/pulse-catalog/pulse-catalog.json
+.tmp-*

.github/workflows/factory-ci.yml

@@ -0,0 +1,55 @@
+name: Factory CI
+
+on:
+  pull_request:
+    paths:
+      - '.dockerignore'
+      - 'factory/**'
+      - '.github/workflows/guide-draft.yml'
+      - '.github/workflows/factory-ci.yml'
+      - 'go/internal/guidecheck/**'
+      - 'go/cmd/lint-guide/**'
+      - 'FACTORY.md'
+      - 'mise.toml'
+  push:
+    branches: [main]
+    paths:
+      - '.dockerignore'
+      - 'factory/**'
+      - '.github/workflows/guide-draft.yml'
+      - '.github/workflows/factory-ci.yml'
+      - 'go/internal/guidecheck/**'
+      - 'go/cmd/lint-guide/**'
+      - 'FACTORY.md'
+      - 'mise.toml'
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go/go.mod
+
+      - name: Factory tests
+        run: bash factory/tests/run.sh
+
+      - name: Shellcheck
+        run: shellcheck factory/scripts/*.sh factory/tests/*.sh
+
+      - name: Guidecheck tests
+        working-directory: go
+        run: go test ./internal/guidecheck ./cmd/lint-guide
+
+      - name: Build factory image
+        run: |
+          docker build --build-arg KIT_VERSION=0.1.98 \
+            --build-arg KIT_SHA256=7d14561469ced8af21df1075a9071d04a7bad1b1c5ff90d685142d3231abae85 \
+            -f factory/Dockerfile .

.github/workflows/go-module-regen.yml

@@ -178,6 +178,8 @@ jobs:
           gh label create "go-module:regen-failed" --color "D73A4A" \
             --description "Go module regen workflow failed" 2>/dev/null || true
           body_file="${RUNNER_TEMP:-/tmp}/go-module-regen-fail.md"
+          # Backticks are literal Markdown in these single-quoted messages.
+          # shellcheck disable=SC2016
           printf '%s\n' \
             'Go module regen failed on `main`.' \
             '' \

.github/workflows/go-module-release.yml

@@ -65,9 +65,9 @@ jobs:
           if [ -z "$bump" ]; then
             msg="$(git log -1 --pretty=%B)"
             case "$msg" in
-              *'[major]'*) bump=major ;;
-              *'[minor]'*) bump=minor ;;
-              *) bump=patch ;;
+              *'[major]'*) bump="major" ;;
+              *'[minor]'*) bump="minor" ;;
+              *) bump="patch" ;;
             esac
           fi
           echo "Bump: $bump"