v2: fail (exit 1) on naming violation

The four wired repos flip the naming job to a required status check
(agenthub#557 WS6); a check that always exits 0 can never gate. v2 makes
the script exit nonzero with FAIL lines; warn-only stays available via
job-level continue-on-error or the legacy @v1 tag. dfritz break-glass
exemption unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -1,8 +1,9 @@
 # action/check-naming
 
 Composite Gitea Action that validates a pull request's head branch name
-and title against the fritzlab naming standard. Always exits 0 —
-warn-only until the Bugs tracking system is live (see
+and title against the fritzlab naming standard. `@v2` fails (exits 1) on
+any violation; `@v1` is the legacy warn-only release that never fails
+(Bugs program: see
 [fritzlab/agenthub#557](https://code.fritzlab.net/fritzlab/agenthub/issues/557)).
 
 ## Standard
@@ -26,15 +27,17 @@ jobs:
   naming:
     runs-on: fritzlab
     timeout-minutes: 5
-    continue-on-error: true   # non-required until Bugs cutover
     steps:
-      - uses: https://code.fritzlab.net/action/check-naming@v1
+      - uses: https://code.fritzlab.net/action/check-naming@v2
         with:
           head-branch: ${{ github.head_ref }}
           pr-title: ${{ github.event.pull_request.title }}
           pr-author: ${{ github.event.pull_request.user.login }}
 ```
 
+To wire a new repo warn-only first, add `continue-on-error: true` to the
+job — the step still fails, but the job cannot block the PR.
+
 ## Inputs
 
 | Name | Required | Description |
@@ -49,16 +52,21 @@ The check validates two things:
 
 1. **Branch form** — must be `<role>/bug-<id>/<kebab>` or `chore/<kebab>`.
    Unknown roles, missing `bug-` segment, uppercase bug-ids, and empty
-   kebab descriptions all produce a `WARN[check-naming]` log line.
+   kebab descriptions all produce a `FAIL[check-naming]` log line.
 
-2. **Title form** — for a `role/bug` branch the title should start with
-   `[bug-<id>] `. For a `chore` branch the title should have no `[bug-id]`
+2. **Title form** — for a `role/bug` branch the title must start with
+   `[bug-<id>] `. For a `chore` branch the title must have no `[bug-id]`
    prefix. If both carry a bug-id they must match.
 
-All violations print a `WARN[check-naming]: ...` line. The step always
-exits 0 so it cannot block a PR. To harden to required after the Bugs
-cutover: remove `continue-on-error: true` from the consuming workflow
-and add the job's context to the repo's `status_check_contexts`.
+Every violation prints a `FAIL[check-naming]: ...` line and the step
+exits 1. To make the check required on a repo: drop any
+`continue-on-error: true` from the consuming workflow and add the job's
+context to the repo's `status_check_contexts` in agenthub `hub/hub.yaml`.
+
+## Versions
+
+- `v2` — enforcing: exits 1 on violation (current).
+- `v1` — legacy warn-only: logs `WARN` lines, always exits 0.
 
 ## Tests