ci: cram: lint component manifest in pipelines

The component manifest lint currently runs only during local validation.
Merge requests get no feedback when new tests silently enter the prplos
remainder.

Add a non-DUT manifest coverage job to every pipeline. Fetch an MR base
when needed and pass it to the lint. Newly-in-remainder warnings then
appear in job output.

Give the job explicit rules: a job without rules keeps the legacy
branches-and-tags default and is never created in merge-request
pipelines, the exact place the diff-base comparison exists for. Skip
scheduled pipelines, which carry no cram work.

Use the digest-pinned testbed v1.3.0 image for Python, YAML, and git. The
MR diff-base comparison requires runtime git for cat-file, fetch, and the
lint script's child processes.

The image runs as the testbed user while the runner checkout has a
different owner. Git otherwise rejects the checkout before lint starts:

```text
fatal: detected dubious ownership in repository at
'/builds/prpl-foundation/prplos/prplos'
```

Pass a safe.directory override for CI_PROJECT_DIR through Git's inherited
configuration environment. Print the selected MR diff base so the
comparison path remains visible in job evidence. Add no hardware runner
tags or build dependencies.

Assisted-by: codex:gpt-5
Assisted-by: claude:fable-5
References: CI-7
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>

.gitlab/testbed.yml

@@ -242,5 +242,34 @@
       export CRAM_TEST_SUITE
     - !reference [.testbed, script]
 
+lint cram component manifest:
+  stage: run
+  image: "registry.gitlab.com/prpl-foundation/prplos/ci/containers/testbed/testbed:v1.3.0@sha256:7f50dde2279c201542569b7f31e965d43a308e245a4ec973df52d581560b0c28"
+  needs: []
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
+      when: never
+    - when: on_success
+  script:
+    - |
+      export GIT_CONFIG_COUNT=1
+      export GIT_CONFIG_KEY_0=safe.directory
+      export GIT_CONFIG_VALUE_0="$CI_PROJECT_DIR"
+
+      base_ref="${CI_MERGE_REQUEST_DIFF_BASE_SHA:-}"
+      if [ -n "$base_ref" ]; then
+        echo "Comparing manifest coverage against MR diff base $base_ref"
+        git cat-file -e "$base_ref^{commit}" 2>/dev/null ||
+          git fetch --no-tags origin "$base_ref"
+        set -- --base-ref "$base_ref"
+      else
+        set --
+      fi
+
+      .gitlab/tests/cram/scripts/check-component-coverage.py \
+        --test-root .gitlab/tests/cram \
+        --manifest components.yml \
+        "$@"
+
 .testbed true.cz:
   extends: .cram_component

.gitlab/tests/cram/README.md

@@ -126,3 +126,7 @@ revision. `--base-list <path>` accepts a newline-separated baseline instead;
 the two baseline options are mutually exclusive. The lint still succeeds when
 a newly added test enters the `prplos` remainder, but prints a warning so the
 assignment can be reviewed.
+
+Merge request pipelines pass the diff base to this lint automatically. Other
+pipeline types run the same manifest checks without a comparison baseline;
+scheduled pipelines skip the job.