chore(codegen): adopt the pending regeneration and reach the generator fixed point

.github/workflows/ci.yml

@@ -43,13 +43,22 @@ jobs:
     timeout-minutes: 60
     env:
       CI: Y
+      # The credential helper installed below reads the token from the
+      # environment of every later step, so it is a job-level value.
+      GH_TOKEN: ${{ github.token }}
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           submodules: false
           fetch-depth: 0
 
+      # Codegen refreshes the declared provider baseline before comparison.
+      # actions/checkout deliberately does not persist credentials, so install
+      # the runner's scoped token through the GitHub CLI's Git credential owner.
+      - name: Configure GitHub authentication
+        run: gh auth setup-git
+
       - name: Install mise toolchain
         uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518  # v4.2.5
         with:

.gitignore

@@ -15,12 +15,6 @@
 # BLOCK: AI/Agent Local Data (NEVER track these)
 .claude/*
 
-# BLOCK: Agent surface outside the workspace root
-.agents/
-
-# Skill scan reports (transient, regenerated by skill_validate.py)
-.agents/skills/*/report.json
-
 # Aider AI data
 .aider/
 .aider.conf.yml
@@ -32,6 +26,55 @@
 .copilot/
 .codeium/
 
+# TRACK: agentsctl-governed project projections
+!.agents/
+!.agents/projection.json
+!.agents/.hooks.json.agents-governance.json
+!.agents/hooks.json
+!.agents/aihub-hooks/
+!.agents/aihub-hooks/**
+!.agents/skills/
+!.agents/skills/**
+.agents/skills/*/report.json
+!.claude/
+!.claude/.settings.json.agents-governance.json
+!.claude/settings.json
+!.claude/aihub-hooks/
+!.claude/aihub-hooks/**
+!.claude/agents/
+!.claude/agents/**
+!.claude/commands/
+!.claude/commands/**
+!.claude/rules/
+!.claude/rules/**
+!.claude/skills/
+!.claude/skills/**
+!.codex/
+!.codex/**
+!.cursor/
+!.cursor/.hooks.json.agents-governance.json
+!.cursor/hooks.json
+!.cursor/aihub-hooks/
+!.cursor/aihub-hooks/**
+!.cursor/commands/
+!.cursor/commands/**
+!.cursor/rules/
+!.cursor/rules/**
+!.cursor/skills/
+!.cursor/skills/**
+!.gemini/
+!.gemini/**
+!.github/agents/
+!.github/agents/**
+!.github/hooks/
+!.github/hooks/**
+!.github/instructions/
+!.github/instructions/**
+!.github/skills/
+!.github/skills/**
+!.opencode/
+!.opencode/**
+
 # Oracle dump files
 **/*.dmp
 **/*.DMP
@@ -237,7 +280,11 @@ legado/
 .venv
 .venv/
 .bin/
+.runtime/
 .tools/
+bin/*
+!bin/mise
+!bin/mise.cmd
 __pycache__/
 !.pre-commit-config.yaml
 

.mise.toml

@@ -16,7 +16,8 @@ locked = true
 # === SECTION: tools (managed) ===
 # Source: config:python_version, config:codegen.scaffold.project.dev native toolchain floors
 #         (kubectl_version, helm_version, kind_version, taplo_version, ast_grep_version,
-#          gitleaks_version, tokei_version, qlty_version, beads.selector, beads.version)
+#          gitleaks_version, tokei_version, kubeconform_version, qlty_version,
+#          beads.selector, beads.version)
 [tools]
 python = "3.13"
 uv = "0.12"
@@ -28,6 +29,7 @@ taplo = "0.10"
 ast-grep = "0.45"
 gitleaks = "8.30"
 tokei = "14.0"
+kubeconform = "0.8"
 # qlty ships no mise registry alias; the github backend selector is the only
 # resolvable form (bare 'qlty' fails mise install: 'not found in registry').
 "github:qltysh/qlty" = "0.642"

.shellcheckrc

@@ -0,0 +1,18 @@
+# FLEXT shellcheck configuration
+# SSOT for shell script static analysis in this physical repository.
+
+shell=bash
+enable=add-default-case
+enable=avoid-null-sha1
+enable=check-extra-masked-returns
+enable=check-set-e-pipefail
+enable=check-unassigned-uppercase
+enable=deprecate-which
+enable=ensure-find-exec-subst
+enable=quote-safe-variables
+enable=require-variable-braces
+
+# Disabled by design for repository scripts
+disable=SC1090  # sourced files may be dynamic
+disable=SC1091  # sourced files may be outside the repository
+disable=SC2154  # variables may be assigned in sourced files