feat: ship a reproducible service-quality workflow

[daichunghy]

What\n\n- Add a deterministic service-quality workflow covering instrument, topic card, gap map, audit, recode, measurement and emitters.\n- Add readable workflow summaries and row/raw-column invariants.\n- Ship the workflow entrypoint in the prepared alpha.6 package so a clean consumer can run it without a source checkout.\n\n## How I checked\n\n

patchgate@0.1.0-dev verify
npm run lint && npm run typecheck && npm run check:fixture-budgets && npm run check:workflow-pins && npm run check:workflow-events && npm run check:doc-links && npm run check:consumer-docs && npm run check:community-schedule && npm run check:application-dossier && npm run check:agent-contract && npm run audit && npm test && npm run test:security && npm run test:github && npm run build && npm run bundle:action && npm run test:consumer-fixture && npm run check:release-candidate && npm run test:cli && npm run verify:dist

patchgate@0.1.0-dev lint
node scripts/lint.mjs

lint ok: 38 TypeScript source files

patchgate@0.1.0-dev typecheck
tsc -p tsconfig.json --noEmit

patchgate@0.1.0-dev check:fixture-budgets
node scripts/check-fixture-budgets.mjs

fixture budget checks passed: 10 API fixtures

patchgate@0.1.0-dev check:workflow-pins
node scripts/check-workflow-pins.mjs

workflow pin checks passed: 5 workflow files

patchgate@0.1.0-dev check:workflow-events
node scripts/check-workflow-events.mjs

workflow event and shadow-permission checks passed: required CI/CodeQL cover merge_group checks_requested and the Action can verify workflow provenance

patchgate@0.1.0-dev check:doc-links
node scripts/check-doc-links.mjs

documentation link checks passed: 79 Markdown files scanned

patchgate@0.1.0-dev check:consumer-docs
node scripts/check-consumer-docs.mjs

consumer documentation check passed: 4 public surfaces reference v0.1.0-beta.5

patchgate@0.1.0-dev check:community-schedule
node scripts/check-community-schedule.mjs

community schedule checks passed: 7 unique substantive posts, two-day cadence, built-in token and duplicate guard

patchgate@0.1.0-dev check:application-dossier
node scripts/check-application-dossier.mjs

application dossier checks passed: qualification=345, credits=440, context=344 characters

patchgate@0.1.0-dev check:agent-contract
node scripts/check-agent-contract.mjs

agent contract ok: verification map and evaluation protocol are present

patchgate@0.1.0-dev audit
npm audit --audit-level=high

found 0 vulnerabilities

patchgate@0.1.0-dev test
vitest run --exclude test/cli-smoke.test.ts

RUN v4.1.11 /Users/macos/Desktop/Github

Test Files 11 passed (11)
Tests 112 passed (112)
Start at 08:55:43
Duration 1.11s (transform 1.25s, setup 0ms, import 3.69s, tests 2.01s, environment 1ms)

patchgate@0.1.0-dev test:security
vitest run test/security.test.ts

RUN v4.1.11 /Users/macos/Desktop/Github

Test Files 1 passed (1)
Tests 14 passed (14)
Start at 08:55:45
Duration 255ms (transform 66ms, setup 0ms, import 150ms, tests 25ms, environment 0ms)

patchgate@0.1.0-dev test:github
vitest run test/integration

RUN v4.1.11 /Users/macos/Desktop/Github

Test Files 2 passed (2)
Tests 33 passed (33)
Start at 08:55:45
Duration 453ms (transform 251ms, setup 0ms, import 483ms, tests 190ms, environment 0ms)

patchgate@0.1.0-dev build
tsc -p tsconfig.json

patchgate@0.1.0-dev bundle:action
ncc build src/action/index.ts -o dist/action --minify --transpile-only

ncc: Version 0.45.0
ncc: Compiling file index.js into ESM
ncc: Using typescript@5.9.3 (local user-provided)
0kB dist/action/package.json
22kB dist/action/113.index.js
285kB dist/action/815.index.js
320kB dist/action/index.js
627kB [1437ms] - ncc 0.45.0

patchgate@0.1.0-dev test:consumer-fixture
node scripts/test-consumer-fixture.mjs

consumer fixture passed: full-SHA reference, clean-room bundle and non-blocking merge-group boundary verified

patchgate@0.1.0-dev check:release-candidate
node scripts/check-release-candidate.mjs

release candidate checks passed: patchgate@0.1.0-dev remains an unpublished development package with a complete CLI/Action pack surface

patchgate@0.1.0-dev test:cli
npm run build && vitest run test/cli-smoke.test.ts

patchgate@0.1.0-dev build
tsc -p tsconfig.json

RUN v4.1.11 /Users/macos/Desktop/Github

Test Files 1 passed (1)
Tests 6 passed (6)
Start at 08:55:51
Duration 9.45s (transform 73ms, setup 0ms, import 161ms, tests 9.21s, environment 0ms)

patchgate@0.1.0-dev verify:dist
node scripts/verify-dist.mjs

Verifying dist/ directory...

✅ SUCCESS: dist/ directory exists.
✅ SUCCESS: Found: /Users/macos/Desktop/Github/dist/src/cli.js
✅ SUCCESS: Found: /Users/macos/Desktop/Github/dist/action/index.js
✅ SUCCESS: Action bundle has no external ajv/yaml runtime import.
✅ SUCCESS: Action bundle starts in a clean room without source schemas or node_modules.
✅ SUCCESS: dist/ mtime is newer or equal to tsconfig.json.
✅ SUCCESS: No raw .ts files leaked into dist/.

Verification complete. passes: 55 tests, 132 packed files, packaged workflow clean-room smoke, schema/error/secret/CLI and agent-contract checks.\n\n## Boundary\n\nThis remains a deterministic research contract. It does not estimate statistics, claim validated scales, external users, or adoption.