Port the pins, vendoring, preapproval and APM sync task logic #330

Problem

The original #330 combines several independent ports and exceeds one reviewable pull request. This body covers the first remaining unassigned slice only: add the existing Python type-check adapter's behavior to the Go CLI, without changing consumer dispatch. The pins, vendoring, preapproval, APM, preview, source-selection, and build-metadata ports already have separate open issues; fuzz orchestration is already implemented. Do not duplicate those issues.

The current adapter invokes pyrefly, normalizes its output, and permits one narrow empty-view exemption. These decisions still live in shell. Under #588, implement this adapter in Go rather than the original inventory's proposed Python destination.

Baseline: origin/main at 2f74b1bccf476f8d142c3b4f6ac14e72302807b1. Behavioral evidence is .devtools/scripts/lint-types.sh, its forwarding entry point tools/lint-types.sh, and the devtools:lint-types task in .devtools/tasks/python.toml. The existing Go command tree is internal/agentrepo/command.go, reached through cmd/agentrepo/main.go.

Acceptance criteria

For agentrepo lint-types, supported inputs require the environment to contain a non-empty PATH. Relative directories and empty components within a non-empty PATH remain supported. An empty or absent PATH is outside this parity contract, because the frozen adapter has no PATH handling and Bash's diagnostic and default search path for those inputs are not part of its interface. This boundary is specific to lint-types.

1. AC1: Invoking agentrepo lint-types runs uv run pyrefly check exactly once with LC_ALL=C.
2. AC2: A successful type-check invocation returns status 0 and prints its combined output with trailing newlines normalized to one newline, including a single newline for empty output.
3. AC3: A failed invocation whose working-directory spelling matches */.claude/worktrees/* and whose combined output contains No Python files matched patterns returns 0 with the existing skip diagnostic instead of the captured output.
4. AC4: Every other failed invocation returns the failing command's exit status and prints its combined output with the same newline normalization as a successful invocation. When the executable is missing, the adapter returns exit status 127 and prints the shell's command-not-found diagnostic on standard output, matching the frozen adapter at .devtools/scripts/lint-types.sh:23 on origin/main.
5. AC5: Extra arguments supplied to the adapter remain ignored, matching the existing adapter's invocation of pyrefly.
6. AC6: Non-functional: identical supported inputs produce the frozen adapter's status, stdout, and stderr on macOS and Linux; the same ordinary-path success and failure cases pass on Windows.
7. AC7: Non-functional: the adapter preserves the caller's working directory and environment apart from the existing child-process locale override.
8. AC8: Existing consumer task and executable entry points retain their current behavior without requiring a newer binary.

Scope and non-goals

Include the additive Go CLI, behavior tests, CLI help, and documentation of its availability. Preserve the exact existing skip diagnostic, substring matching, logical working-directory spelling, output merging, empty output, command-not-found behavior, and exit statuses. No real type-check exemption is exercised against repository code as a substitute for tests; use controlled fixtures.

Non-goal: changing the hidden-path exemption, selecting first-party files, forwarding previously ignored arguments, or fixing the distinct defect in #374. This is behavior parity only. If #374 lands first, rebaseline against its accepted behavior before implementing this slice; do not restore an exemption that it removed.

Out of scope: the other task ports, consumer dispatch, binary distribution, shell removal, configuration changes, and editing or deleting any frozen shell implementation or its existing Bats coverage. Add no new shell. Consumer cutover is a separate slice after distribution and compatibility are settled.

Approach

Reuse the existing Cobra command tree in internal/agentrepo/command.go and the entry point in cmd/agentrepo/main.go; add the adapter under internal/ with Go tests rather than introducing another executable or command framework. Follow the existing subprocess and CLI-test patterns in internal/agentrepo/fuzz.go and internal/agentrepo/fuzz_test.go, which already support an external-tool adapter. Do not reuse the fuzz runner's discovery-error policy for type checking.

Establish failing Go tests for each branch before implementing it. Use a Go test helper as the external-command substitute, and compare Unix fixture results against the unchanged shell as an oracle. Preserve shell command-substitution output semantics explicitly. Document the Go command as additive; leave the existing tasks and shell files untouched throughout this PR, preserving the N-2 policy in docs/compatibility.md.

Dependencies

Native blockers: None; this additive command can land independently of the other ports.

• Replace complex shell with tested Go, starting with gates and merging #588 (open): Go migration direction; retain the frozen shell during this slice.
• lint-types skips type checking in every agent worktree and fails for consumers with no first-party Python #374 (open): related type-check correctness change, not a blocker or part of this port. Rebaseline if it lands first; coordinate ownership rather than duplicate its behavior changes.
• Ship the Go binaries as release assets installed through mise's github backend #333 (open): binary distribution prerequisite for the later consumer cutover, not for this additive command.
• feat(fuzz): move fuzz orchestration to Go #805 (closed): fuzz port already supplies a reusable Go subprocess/test pattern; no fuzz reimplementation is needed.

Size

S. One PR, estimated 250–450 code lines including Go tests and under 200 prose lines; hard limits are 800 code and 2000 prose lines. Consumer cutover and every other original task family remain separate slices.

Verify plan

• AC1: A Go command recorder asserts one invocation, exact arguments, and the child's C locale.
• AC2: Go table tests cover empty output, stdout only, stderr only, interleaved streams, and multiple trailing newlines on success.
• AC3: Go table tests cover matching and nonmatching directory spellings, matching text on either stream, embedded matching text, and status 0 with matching text. Compare the exact skip diagnostic with the frozen oracle.
• AC4: Go tests cover ordinary-path empty-view failure, hidden-path unrelated failure, mixed output, missing executable under a non-empty PATH that lacks uv, and representative nonzero statuses; Unix parity tests compare status and both adapter streams separately, and for the missing-executable case compare the exit status (127) and the command-not-found diagnostic on standard output against the frozen adapter.
• AC4 (lookup): Unix parity tests keep relative directories, current-directory lookup, leading and trailing empty components, entry order, symlinks, and permission failures. They drop only the whole-empty PATH and absent PATH cases, with the supported-inputs sentence as the reason.
• AC5: Go CLI tests pass extra options and positional values and assert that none reach the child.
• AC6: Run focused Go tests on macOS, Linux, and Windows; run frozen-shell parity tests on macOS and Linux, and document the same PATH boundary in the command's availability notes. Use simulated child tools rather than invoking Python or resolving dependencies in these tests.
• AC7: Go tests assert the child receives the unchanged directory and unrelated environment values, and that invoking the adapter does not change the parent's directory or environment. Include logical-directory spelling fixtures.
• AC8: Diff inspection confirms no task-dispatch or shell changes; existing type-check entry-point checks retain their baseline result. Run go test ./internal/agentrepo, applicable repository lint and test gates, and verify the documented N-2 behavior remains unchanged.

Risks

Go stream capture or newline trimming could alter diagnostics. Resolving a logical directory to a physical path could alter the exemption. Incorrect subprocess status mapping could hide a failure. Fixture comparisons must cover each boundary.

This parity port preserves the known exemption defect tracked by #374; it does not claim to fix type-check coverage. Shipping only an additive command avoids changing the current consumer path. Undo: revert this PR to remove the new command; the unchanged consumer path continues to operate.

Operator authority

None