Split CI into one job per gate under Pipeline Complete #23

Parent

#21

What to build

The single CI job becomes one job per gate: typecheck, lint, format, architecture, contracts (the ADR, link and manifest checks), tests with coverage, package contents, actionlint and the secret scan. Pipeline Complete stays the one required check, and it fails when any job fails, is cancelled or is skipped. Every job starts from one composite setup action and runs with least privilege and a timeout. Every action and reusable workflow in the repository is pinned by commit SHA with a version comment.

A test fails when an npm script runs in no workflow, or when a workflow calls a script that does not exist, unless the script is listed as pending with a reason and the ticket that will wire it. From here on, a new gate arrives in the same pull request as the script it runs.

One ADR in docs/adr/architecture/: the gate grows with the code.

Acceptance criteria

• Each gate reports as its own job on a pull request.
• Pipeline Complete fails when one job fails and when one job is skipped, shown on a throwaway branch.
• No workflow references an action or a reusable workflow by tag or by branch.
• The tiers test fails for an unwired script, and for a workflow that names a missing script.
• The branch ruleset still finds a check named exactly Pipeline Complete.

Blocked by

• Run the suite on Vitest and make the tooling strict TypeScript #22