ci(organization): check that every enabled repository carries mise.toml, mise.lock, and its verify gate (ADR-0043)

[bketelsen]

Summary

• Adds scripts/check-fleet-conventions.mjs (+ scripts/lib/fleet-conventions.mjs), which reads every fleet_state: enabled declaration under organization/repositories/** and checks its GitHub default branch for mise.toml (a [tools] table), a non-empty mise.lock, and either a Go Makefile with verify:/check:/ci: targets or a Node package.json with scripts.verify/scripts.check — presence only, never a version compare (ADR-0043).
• Wires it in as npm run check:fleet, its own CI job fleet-conventions (network-dependent, so intentionally not part of npm run check/verify), SHA-pinned actions, permissions: contents: read, persist-credentials: false, and (via the workflow's existing top-level trigger) merge_group.
• Names the script/job in docs/design/quality-loop.md and adds the npm run check:fleet line beside check:organization in AGENTS.md.
• test/fleet-conventions.test.mjs: a fake fetcher proves (a) a conformant Go repo and a conformant Node repo pass, (b) a repo missing mise.lock fails naming it, (c) a Makefile lacking verify: fails naming the target, (d) a disabled declaration is never fetched.

Fleet-conventions job result on this PR

Updated 2026-08-24 23:40Z (head a6b39f4): the job is green — CI run 32790378452 prints ok for all seven enabled declarations (clix, core, firn, snowcat, snowcat-cockpit, std, updex).

History, kept for the record: the first run on head 55d2bcb (20:43Z) found two of seven non-conformant — FAIL frostyard/clix: Makefile missing ci: target and FAIL frostyard/firn: Makefile missing ci: target — real ADR-0043 drift the check exists to catch, not a bug in the check. Those repositories added their ci: targets the same evening (frostyard/clix#85, frostyard/firn#77, both merged); a6b39f4 merges main (resolving a package.json scripts conflict with #115) and its run is the green one above.

Verification

npm ci
npm run check         # check:docs, check:organization, test — all pass, no network
node --test test/fleet-conventions.test.mjs   # 4/4 pass
GITHUB_TOKEN=$(gh auth token) npm run check:fleet   # 7/7 ok on a6b39f4 (was 5 ok / 2 FAIL on 55d2bcb before clix#85 and firn#77 merged)
grep -c 'version' scripts/check-fleet-conventions.mjs scripts/lib/fleet-conventions.mjs   # 0, 0 — no version comparison

Test plan

• npm run check at the repository root — all pass, no network
• node --test test/fleet-conventions.test.mjs — 4/4 pass
• npm run check:fleet against the live fleet (with a token, to avoid unauthenticated rate limiting) — 7/7 ok on a6b39f4; on the first head it correctly failed clix/firn naming the missing ci: target
• CI green on this PR — docs-gate, fleet-conventions (7 ok lines), and scaffold-e2e all green on a6b39f4 (run 32790378452)

🤖 Generated with Claude Code