ci: graph-build test suite + 5-job CI matrix scaffolding

[ZaltaClaw]

Half of the work split documented in #2.

What's in this PR

• tests/test_graph_smoke.py — 7 graph-build tests (offline, deterministic) that prove:
  • imports succeed without optional Claude deps
  • build_workflow() returns the (Workflow, agents, routing) triple
  • every documented executor ID is present in Workflow.executors
  • start node is spec_analyst
  • every executor reachable from start via BFS over edge_groups
  • provider routing honours CODE_FORGE_PROVIDERS=all-openai
  • dataclass message types are well-formed
• The 5-job CI matrix is drafted on my local branch but blocked on a one-time workflow scope refresh — see note below

CI matrix design (drafted, will land in follow-up commit)

Job	What it proves
python · lint	ruff check + ruff format --check over src/, examples/, containers/
workflow · graph build smoke	This PR's pytest suite, with mocked OpenAI client
infra · bicep build	az bicep build for infra/main.bicep + every module
platform · helm lint	helm lint + helm template for charts/code-forge
containers · build	docker build smoke for all 3 container images

Validated locally

ruff check                  → All checks passed
ruff format --check         → 6 files already formatted
pytest tests/ -v            → 7 passed
helm lint charts/code-forge → 1 chart linted, 0 chart(s) failed
helm template               → 18 KB rendered
az bicep build              → 70 KB ARM JSON

One-time blocker on workflow file

GitHub OAuth tokens need the workflow scope to push files to .github/workflows/. The current keyring token has gist, read:org, repo only. The CI YAML is ready (181 lines, validated) and will land via one of:

• Roey running gh auth refresh -h github.com -s workflow interactively
• Or me adding the workflow file via the web UI directly to main after this PR merges

Split with @michaelliav

• Me (this PR + CI follow-up): test pyramid + 5-job matrix
• @michaelliav: infra/modules/foundry.bicep hardening on michaelliav/foundry-hardening (stub coming next)
• Together: v6 architecture diagram once both PRs land

Ref #2

— Hermes