dogfood: pre-publish reads fmt, clippy, test and coverage from the commit's CI (#4672)

[noahgift]

Stacked on #4882 (2a). Refs #4672.

What changes

dogfood --phase pre-publish re-ran fmt, the test suite and coverage on the release commit, even though CI and the coverage nightly had already judged that same commit. In pre-publish, those rows now read the existing result:

row	in pre-publish, reads for exactly HEAD's sha
fmt	CI / ci / gate
test	CI / workspace-test
coverage	scripts/release/tag_coverage_gate.sh --resolve HEAD, the coverage-nightly receipt against COV_FLOOR (#4734) that autopilot cut_tag already requires before git tag. PASS only on exit 0
clippy	still measured. The ci / gate clippy is narrower (default features, unused-variables allowed, a lib-only fallback), so reading it would weaken the row

When there is no green receipt, the row is RED, never a skip. All of these are red:

• the newest run is red, pending, cancelled or skipped;
• runs disagree at the same start time;
• the check is missing;
• the check is green, but on another commit;
• the coverage receipt is missing, below the floor, or for another commit;
• the GitHub read failed;
• a reader is missing;
• the tree has uncommitted tracked changes.

Every other phase still measures these rows as before. No threshold, waiver or report-only mode changes.

Files

• scripts/release/sha_checks.sh: one GraphQL call per invocation (Feature Request: Decision Tree & Random Forest for Classification Tasks #1); the newest run on the sha decides. Its --self-test plants 21 rows, including a red check for the sha, a missing check and a green check for a different sha.
• scripts/dogfood.sh: adds ci_mark and cov_mark, called from the pre-publish branch. The measuring commands stay in its else.
• scripts/check_dogfood_reads_ci.sh, in guard_tree.sh --no-cargo:
  • R1: the sha_checks.sh and tag_coverage_gate.sh self-tests pass.
  • R2 (structure): fmt and test are ci_mark calls and coverage is cov_mark, once each in pre-publish. clippy is measured in every phase. Pre-publish never PASSes a coverage it did not read.
  • R3 (behaviour): it lifts the runner's own read block and drives it against planted rows and a planted coverage reader, for a real scratch commit. It runs 9 cases.
  • --self-test: 9 planted runner defects, each of which turns the guard RED: rerun, nodirty, skipread, wrongspec, clippyread, covpass, covmissing, covskip, covwrongsha.
• contracts/dogfood-runner-unification-v1.yaml: F-DOG1-032 and F-DOG1-033.

Receipts (tree deb4f19)

• sha_checks.sh --self-test: 21/21. tag_coverage_gate.sh --self-test: PASS.
• check_dogfood_reads_ci.sh: PASS. Its --self-test: 9/9 plants RED.
• These dogfood guards are green: row-order (enforced), no-defer, shim, matrix, version-row and autopilot-close.
• check_guards_are_wired.sh and check_bashrs_gate.sh: green.
• pv validate on the contract: valid.
• Live check: tag_coverage_gate.sh --resolve on main e95ae82 exits 1, because there is no nightly receipt on that sha. That red is intended.
• A C314 round at deb4f19 (two non-author model lanes) agreed 2/2 YES, and both lanes caught a planted decoy.

Diff size

Until #4882 lands and this PR retargets to main, its diff also shows the main merge it carries.

🤖 Generated with Claude Code

[noahgift]

#4886: my YES and the non-author sign-off round from deb4f19 now bind to 6bac6be.
git diff deb4f19d5e 6bac6be648 changes only the PR review evidence (one findings.sarif and one receipt.intoto.jsonl). Outside that evidence, scripts, contracts and the rest of the tree are byte-identical to the head I reviewed and the round judged. 6bac6be contains main, including #4882.

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=4886 head=e18a802ed82b9f5e75ea6ef249f5f0bc239b8165 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

Re-review of #4886 at b5daf30: YES.

• Since 6bac6be the scripts change in 3 lines. dogfood.sh:698 now writes tag_coverage_gate.sh's output to coverage-gate.log instead of coverage-receipt.log, and check_dogfood_reads_ci.sh renames two case labels. cov_mark still marks coverage PASS only when tag_coverage_gate.sh --resolve exits 0 for HEAD's sha.
• This fixes a false match, not a reader hidden from the guard. At 6bac6be, check_coverage_receipt.sh S4 was WRONG, "read by scripts/check_dogfood_reads_ci.sh scripts/dogfood.sh", because of those names. dogfood.sh never fetches or parses the receipt: the release gate it calls does.
• Measured at b5daf30: check_coverage_receipt.sh exits 0 (21 rows + 4 structural, every mutant killed). check_dogfood_reads_ci.sh exits 0 and its --self-test passes.

Non-author sign-off round, bound to b5daf30: AGREED 2/2 (claude-sonnet-5-5, gemini-3.1-pro-high). Both lanes said YES to the change as written and NO to a planted decoy that adds a receipt download under a split string to dodge S4. Both cited scripts/dogfood.sh:698-699.

[noahgift]

#4886: my YES and the non-author sign-off round (AGREED 2/2) from b5daf30 now bind to 6e850f3. The one commit since then adds only PR review evidence, with no file changed outside evidence/.

[noahgift]

#4886: my YES and the non-author sign-off round (AGREED 2/2) from b5daf30 now bind to e18a802. Outside evidence/, the tree is identical to b5daf30. At this head check_coverage_receipt.sh exits 0, and S4 is ok.

Non-blocking, for the author:

• The edited C129 receipt now records the m5 command as bash -c 'bash scripts/check_cov*_receipt.sh'. The glob resolves to the same single script, but that is not literally the command that ran. If S4 should never scan review prose, a ruled S4 exclusion of evidence/ would be cleaner than rewording receipts.
• check_pr_review_receipt.sh rejects this receipt directory as unsigned (no .minisig). The same was true before this commit, so this edit did not cause it. It still needs signing before the receipt counts.