chore: add reusable subgraph-notify workflow + installer script + onboarding docs

Every public subgraph now auto-triggers a cyber rebuild on push via
repository_dispatch. Reusable workflow keeps dispatch logic in one place.
`nu scripts/add-notify-workflow.nu` installs the caller in new repos.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: mastercyb

.github/workflows/subgraph-notify.yml

@@ -0,0 +1,15 @@
+name: Subgraph notify (reusable)
+
+on:
+  workflow_call:
+
+jobs:
+  dispatch:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger cyber rebuild
+        uses: peter-evans/repository-dispatch@v3
+        with:
+          token: ${{ secrets.CYBER_DISPATCH_TOKEN }}
+          repository: cyberia-to/cyber
+          event-type: content-changed

root/cyber/subgraphs.md

@@ -16,6 +16,29 @@ the workspace anchor at [[.github]] owns all subgraph concerns. under it, [[.git
 
 cyber itself declares no subgraphs — that concern belongs to the workspace. the authoritative, always-current set is the namespace itself.
 
+## adding a new subgraph
+
+1. add a declaration to `subgraphs/<name>.md` with `visibility: public` (or `private` to exclude from prod build)
+2. add `notify-cyber.yml` to the new repo so pushes trigger a rebuild:
+
+```yaml
+# .github/workflows/notify-cyber.yml
+name: Notify cyber
+
+on:
+  push:
+    branches: [master, main]
+
+jobs:
+  notify:
+    uses: cyberia-to/cyber/.github/workflows/subgraph-notify.yml@master
+    secrets: inherit
+```
+
+3. add `CYBER_DISPATCH_TOKEN` to the repo's secrets (Settings → Secrets → Actions). the token is a GitHub PAT with `repo` scope on `cyberia-to/cyber`. the org-level secret covers all repos — no per-repo config needed if it is already set at org level.
+
+to add the workflow to all existing repos at once: `nu scripts/add-notify-workflow.nu` from the cyber root. dry-run first with `--dry-run`.
+
 ## canonical set
 
 follow [[.github/subgraphs]] for the full list of declarations.

scripts/add-notify-workflow.nu

@@ -0,0 +1,76 @@
+#!/usr/bin/env nu
+# Adds notify-cyber.yml caller workflow to all public subgraph repos.
+# Run from cyber/ root: nu scripts/add-notify-workflow.nu [--dry-run]
+
+def parse_field [content: string, field: string] {
+    let matches = ($content | lines | where {|l| $l | str starts-with $"($field):"})
+    if ($matches | is-empty) { return "" }
+    $matches | first | str replace $"($field):" "" | str trim
+}
+
+def main [--dry-run (-n)] {
+    let base = ($env.HOME | path join "cyberia-to")
+    let caller = "name: Notify cyber
+
+on:
+  push:
+    branches: [master, main]
+
+jobs:
+  notify:
+    uses: cyberia-to/cyber/.github/workflows/subgraph-notify.yml@master
+    secrets: inherit"
+
+    let subgraphs = (glob subgraphs/*.md | each {|f|
+        let content = (open --raw $f)
+        let name = (parse_field $content "name")
+        let repo = (parse_field $content "repo")
+        let visibility = (parse_field $content "visibility")
+        let archived = (parse_field $content "archived")
+        let orphan = (parse_field $content "orphan")
+        let local_only = (parse_field $content "local-only")
+        {
+            name: $name,
+            repo: (if $repo == "" { $name } else { $repo }),
+            visibility: (if $visibility == "" { "public" } else { $visibility }),
+            archived: ($archived == "true"),
+            orphan: ($orphan == "true"),
+            local_only: ($local_only == "true"),
+        }
+    } | where {|s| $s.name != "" and $s.name != "cyber" and $s.visibility != "private" and $s.archived != true and $s.orphan != true and $s.local_only != true })
+
+    for s in $subgraphs {
+        let repo_path = ($base | path join $s.repo)
+        let workflow_dir = ($repo_path | path join ".github" "workflows")
+        let workflow_file = ($workflow_dir | path join "notify-cyber.yml")
+
+        if not ($repo_path | path exists) {
+            print $"  skip  ($s.repo): not checked out locally"
+            continue
+        }
+
+        if ($workflow_file | path exists) {
+            print $"  ok    ($s.repo): already has notify-cyber.yml"
+            continue
+        }
+
+        if $dry_run {
+            print $"  add   ($s.repo): would create ($workflow_file)"
+            continue
+        }
+
+        mkdir $workflow_dir
+        $caller | save --force $workflow_file
+
+        cd $repo_path
+        git add .github/workflows/notify-cyber.yml
+        git commit -m $"chore: add notify-cyber workflow — trigger cyber rebuild on push
+
+Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>"
+        git push origin HEAD
+        print $"  done  ($s.repo)"
+        cd ($base | path join "cyber")
+    }
+
+    print "\nDone."
+}