chore: initialize IKE build standards scaffolding

- Add IKE-managed .gitignore entries for local state and version plans
- Add scaffold.lock tracking applied templates (standards v171)
- Add versions-upgrade-rules.yaml for dependency management
- Update ike-parent version from 55 to 70

Author: kec

.gitignore

@@ -234,3 +234,11 @@ htmlReport
 ###################
 **.develocity/
 .claude
+# BEGIN ike-managed
+# IKE local state (never committed)
+.ike/vcs-state
+
+# ws:/ike: versions-upgrade plan file (transient — generated by
+# the *-draft goal and consumed by the matching *-publish goal)
+versions-upgrade-plan.yaml
+# END ike-managed

.ike/scaffold.lock

@@ -0,0 +1,12 @@
+schema: 1
+standards-version: '171'
+applied: '2026-05-15T06:03:21.572427Z'
+files:
+  .gitignore:
+    tier: tracked-block
+    template-sha: sha256:7492c8da4e0c180719203e280fdee3b22dae90ed3aece52b3fbd583690e41c02
+    applied-sha: sha256:7492c8da4e0c180719203e280fdee3b22dae90ed3aece52b3fbd583690e41c02
+  versions-upgrade-rules.yaml:
+    tier: tracked
+    template-sha: sha256:8abeed57639896a50c0c3cb75bf2478658b149a9ee41193065eb4dab6543fc2d
+    applied-sha: sha256:8abeed57639896a50c0c3cb75bf2478658b149a9ee41193065eb4dab6543fc2d

pom.xml

@@ -5,7 +5,7 @@
  <parent>
         <groupId>network.ike.platform</groupId>
         <artifactId>ike-parent</artifactId>
-        <version>55</version>
+        <version>70</version>
         <relativePath/>
     </parent>
     <groupId>dev.ikm.komet</groupId>

versions-upgrade-rules.yaml

@@ -0,0 +1,62 @@
+# IKE workspace version-upgrade ruleset.
+#
+# Read by `ws:versions-upgrade-draft` (workspace scope) and
+# `ike:versions-upgrade-draft` (single-module scope) to decide which
+# coordinates may be upgraded, which are pinned, and which are
+# explicitly blocked. The corresponding `-publish` goals consume the
+# generated plan; this file controls only the planning step.
+#
+# Shipped as a tracked scaffold template by `ike-build-standards`.
+# Edit freely — the next `ike:scaffold-publish` records the on-disk
+# hash in `.ike/scaffold.lock`, detects user edits on subsequent
+# runs, and leaves them in place. Divergence from the shipped
+# template is surfaced as a unified diff in `ike:scaffold-draft`
+# output so you can merge upstream changes when ready.
+#
+# Schema reference: see `VersionUpgradeRulesReader` in
+# `network.ike.workspace`.
+
+schema-version: "1.0"
+
+# Coordinates with no matching rule fall through to default-action.
+# `block` is the safe default — unknown coordinates are never
+# silently upgraded just because a newer release happens to exist.
+default-action: block
+
+# Rules are evaluated in declaration order; the first match wins.
+# `match` syntax: "groupIdPattern:artifactIdPattern", with `*` as
+# a wildcard. A bare pattern with no `:` matches the groupId only,
+# with `*` for artifactId — so `network.ike.*` is shorthand for
+# `network.ike.*:*`.
+rules:
+
+  # ── IKE-owned coordinates ────────────────────────────────────────
+  # Track the latest released version of every IKE artifact —
+  # ike-tooling, ike-docs, ike-platform, ike-lab, etc. The
+  # candidate resolver only proposes non-SNAPSHOT releases.
+  - match: "network.ike.*"
+    action: allow
+
+  # ── Common test dependencies ─────────────────────────────────────
+  - match: "org.junit.jupiter:*"
+    action: allow
+  - match: "org.assertj:assertj-core"
+    action: allow
+
+  # ── Examples (uncomment and adapt as needed) ─────────────────────
+  #
+  # Pin a coordinate at a known-good version regardless of what
+  # the resolver discovers. Useful for libraries with breaking
+  # changes you have not yet adopted.
+  #
+  # - match: "com.example:frozen-lib"
+  #   action: pin
+  #   version: "1.2.3"
+  #
+  # Explicitly block with a reason. The reason surfaces in the
+  # generated plan so future readers understand why the
+  # coordinate is held back.
+  #
+  # - match: "com.example:broken-lib"
+  #   action: block
+  #   reason: "Known to fail integration tests on Java 25"