ci: check PR task IDs and record merged tasks

.github/workflows/check-task-id.yml

@@ -0,0 +1,19 @@
+name: check-task-id
+
+# Runs on every base branch, not just main: a stacked child PR opens against its
+# parent task branch, and a missing or malformed Task-ID must fail then — not
+# minutes before the merge, when GitHub re-targets the PR onto main.
+on:
+  pull_request_target:
+    types: [opened, edited, synchronize, reopened]
+
+jobs:
+  check-task-id:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: globster-monday/workspace/.github/actions/check-task-id@main
+        with:
+          pr-author: ${{ github.event.pull_request.user.login }}
+          pr-body: ${{ github.event.pull_request.body }}
+          app-id: ${{ secrets.TASK_SYNC_APP_ID }}
+          app-private-key: ${{ secrets.TASK_SYNC_APP_PRIVATE_KEY }}

.github/workflows/notify-task-merged.yml

@@ -0,0 +1,25 @@
+name: notify-task-merged
+
+# `branches: [main]` is load-bearing, not incidental. A task completes only when
+# its PR merges into main, so a stacked child merged into its *parent* branch
+# must not mark its task done — and the two tasks would collapse into one main
+# commit. Keep the filter; stacks land bottom-up into main
+# (guidelines/workflow.md § "Stacked PRs").
+on:
+  pull_request_target:
+    branches: [main]
+    types: [closed]
+
+jobs:
+  notify:
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    steps:
+      - uses: globster-monday/workspace/.github/actions/notify-task-merged@main
+        with:
+          pr-author: ${{ github.event.pull_request.user.login }}
+          pr-body: ${{ github.event.pull_request.body }}
+          repository: ${{ github.repository }}
+          merge-sha: ${{ github.event.pull_request.merge_commit_sha }}
+          app-id: ${{ secrets.TASK_SYNC_APP_ID }}
+          app-private-key: ${{ secrets.TASK_SYNC_APP_PRIVATE_KEY }}