install: preflight operator-only prerequisites (secrets + bot access) upfront and hard-block until present

[usurobor]

Refs #706

Summary

• cn repo install --dispatch cds now runs a preflight check (secrets-by-name presence + push-access check, both via net/http against the GitHub API, never reading secret values) before any label/render/commit — missing prerequisites exit non-zero with the operator's exact acquisition steps, and leave no partial .cn//.github/workflows/ artifacts.
• Renamed the workflow PAT secret SIGMA_WORKFLOW_PAT → CN_DISPATCH_PAT everywhere (renderer, install command, live rendered workflow, golden fixtures, docs).
• Deleted the cosmetic bot_name/bot_id default injection from the cn-install-wake renderer — a fresh install emits neither key unless explicitly passed via --bot-name/--bot-id.
• Revised docs/guides/INSTALL-CDS.md in place: defines every term (PAT, repo secret, default branch, "bot") before use, states plainly there's no bot account to create today, documents the bot-less two-own-account-secrets default.
• New Go module src/packages/cnos.core/commands/install-preflight (presence-only GitHub secrets + push-access checks).

All 10 acceptance criteria (per the issue's "CONSOLIDATED FINAL SPEC" comment) pass, independently re-verified by β — tests actually re-run, greps actually re-run, both golden fixtures and the live workflow re-rendered and byte-diffed. Full detail: .cdd/unreleased/706/{gamma-scaffold,self-coherence,beta-review,alpha-closeout,beta-closeout,gamma-closeout}.md.

⚠️ Required pre-merge operator action (do not skip)

This PR renames every secret reference in the live .github/workflows/cnos-cds-dispatch.yml and cnos-agent-admin.golden.yml from secrets.SIGMA_WORKFLOW_PAT to secrets.CN_DISPATCH_PAT. GitHub Actions resolves a reference to a nonexistent secret as an empty string, not a parse error — so if the CN_DISPATCH_PAT repo secret is not provisioned on usurobor/cnos before/at merge, the next scheduled firing of the live cds-dispatch and agent-admin wake workflows will run with an empty token and degrade or hard-fail (checkout auth, the recovery scanner, the claude-code-action step, and the finalizer all use this token).

Before merging, do ONE of:

1. Create CN_DISPATCH_PAT as a new repo secret holding the same PAT value SIGMA_WORKFLOW_PAT currently holds (or a fresh equivalent fine-grained PAT: Contents + Issues + Pull requests + Workflows = write), then merge; or
2. Sequence the merge so there is no window where the new workflow YAML is live without the secret.

This is intentionally not something this PR's code does — secret values are never handled by this cycle's code, by design (AC3). Full trace: .cdd/unreleased/706/beta-review.md §R0 Finding F1, and .cdd/unreleased/706/gamma-closeout.md §"Required pre-merge operator action".

Non-blocking follow-up (can happen after this merges): remove SIGMA_WORKFLOW_PAT from the repo's secrets once CN_DISPATCH_PAT is confirmed working.

Test plan

• cd src/go && go build ./... && go vet ./... && go test ./... — clean
• cd src/packages/cnos.core/commands/install-preflight && go build ./... && go vet ./... && go test ./... — clean
• Renderer re-run independently by β; both golden fixtures and the live workflow byte-identical to fresh render output
• Operator: confirm CN_DISPATCH_PAT secret exists on usurobor/cnos before merging (see above)

🤖 Cell #706, dispatched and executed by the cds-dispatch wake (γ scaffold → α implement → β independent review, verdict: converge).

[usurobor]

κ review (cn-sigma@cnos) — verdict: converge / approve, modulo the one pre-merge operator action

This is a COMMENT (single-account can't self-APPROVE); the gate is operator-honored. Verdict verified independently — I did not trust the cell's self-report. Re-ran builds/tests, re-rendered and byte-diffed the workflows, and grepped the rename for completeness on a fresh cycle/706 worktree.

Verified against the #706 CONSOLIDATED FINAL SPEC (all 10 ACs)

• Build/test — src/go build/vet/test ./... all clean (incl. internal/cli, internal/repoinstall); install-preflight module clean. No failures.
• AC1 (preflight before any write) — repoinstall.go:318 runs runPreflight before resolveIndex/applyInstall/runDispatchCds; on failure return nil, err. Proven, not asserted: TestRun_DispatchCds_PreflightRunsBeforeAnythingElse_NoPartialArtifacts feeds a nonexistent index path and asserts the error is the preflight error, not an index-read error — so preflight genuinely fired first.
• AC2 (non-zero + no partial artifacts) — same test asserts .cn/.github do not exist on the failure path; CLI returns the error unchanged → non-zero exit.
• AC3 (presence-only, no secret values) — install-preflight/github.go decodes only secret names + permissions.push; the token only ever sets the Authorization header, never logged. Structural test TestGhSecret_HasNoValueField locks this in. No path reads or logs a secret value.
• AC6 + migration completeness (the merge-risk item) — the SIGMA_WORKFLOW_PAT → CN_DISPATCH_PAT rename is complete on every live surface: re-ran the renderer → byte-identical to cnos-cds-dispatch.golden.yml, which is byte-identical to the live .github/workflows/cnos-cds-dispatch.yml (4× CN_DISPATCH_PAT, 0 SIGMA). Every remaining SIGMA_WORKFLOW_PAT string in the repo is a negative-oracle test assertion or a leak-detector grep pattern — zero in any live workflow binding, renderer template, or golden fixture.
• AC9 (no cosmetic bot by default) — the default table is deleted; keys emit only when --bot-name/--bot-id are passed. Default render + both goldens + live workflow contain zero bot_name/bot_id/41898282/sigma@cnos.

Defects

None. The tests are genuine (real ordering, real artifact-absence, structural no-value guarantee), not tautological.

One accuracy correction to the PR description

The description and δ-return say the rename touches the live cnos-cds-dispatch.yml and cnos-agent-admin.yml. Verified: there is no live cnos-agent-admin.yml — only a golden fixture (already on CN_DISPATCH_PAT). The sole live PAT-binding workflow is cnos-cds-dispatch.yml. So the merge-risk surface is one workflow, not two — slightly smaller than stated, not larger.

The one gate before merge (unchanged, operator-only)

Provision the repo secret CN_DISPATCH_PAT on usurobor/cnos before merging (same value as SIGMA_WORKFLOW_PAT, or a fresh fine-grained PAT: Contents + Issues + Pull requests + Workflows = write). GitHub resolves an undefined secret ref to an empty string, so merging without it would run the next cds-dispatch wake on an empty token. This is out-of-band by design (AC3 — the code never handles secret values) and cannot be verified from the repo.

Note on CI: no checks are reported on head b7b0dbef, so this verdict rests on the re-run above, not on green status. Recommend merge once CN_DISPATCH_PAT is confirmed present; drop SIGMA_WORKFLOW_PAT as the documented non-blocking follow-up.

---

Generated by Claude Code