Print the commit preflight report from agentrepo commit #851

Problem

preflight.sh is 338 lines of report assembly that the commit skill inlines before it stages anything. It checks worktree readiness, preconditions, pre-approval, delegation, the reviewer, staged, unstaged and untracked paths, the capped diff, recent commits and the message rules. It is under the shell freeze in #588, and the unattended wrapper forwards to it.

Part of #322, within #588. Child 02 in #322's Children list. Delivers in Go the behavior of packages/agents/source/skills/commit/shared/scripts/preflight.sh as agentrepo commit preflight, and the Go port of the worktree readiness check in packages/agents/source/lib/worktree-ready.sh that the report depends on.

Acceptance criteria

1. AC1: Given a clean or dirty worktree, when agentrepo commit preflight runs, then it prints the same == section == headers, in the same order, with the same line shapes as the shell report.
2. AC2: Given the combined staged and unstaged patch is longer than the cap (default 600 lines, overridable by COMMIT_PREFLIGHT_DIFF_LINES), when the report prints the diff, then it prints the per-path instruction instead of the patch.
3. AC3: Given COMMIT_PREFLIGHT_FETCH=0, when the report runs, then it does not run the report's origin fetch and the fetch line says "skipped"; given the reporting fetch fails or times out (COMMIT_PREFLIGHT_FETCH_TIMEOUT, default 10 seconds), then the report continues and the fetch line says "failed (origin counts below may be stale)".
4. AC4: Given COMMIT_AGENTMSG is not gitignored, absent or empty, or holds a leftover draft, when the report runs, then it prints the same lines as the shell: a warning line for the missing ignore entry, one shared line for absent and empty, and its own line for a leftover draft.
5. AC5: Given commit-lint is not installed, when the report runs, then it exits 1 and names the mise pin to add.
6. AC6: Given missing commit-msg, pre-commit or post-commit hooks, when the report runs, then each missing hook is named with the install task.
7. AC7: Given a session pre-approval, a delegation checker, or neither, when the report runs, then the pre-approval and delegation lines match the shell text, including the Touch ID note.
8. AC8: Given a configured sign-off identity, a permitted Git identity or a denied one, when the report runs, then it prints the identity, falls back, or refuses with the configuration guidance.
9. AC9: Given COMMITLINT_* overrides, when the message rules print, then the overridden bounds appear.
10. AC10: Given untrusted repository configuration or an unavailable commit style, when the report runs, then it refuses with the same message and exit status as the shell's worktree readiness check.
11. AC11: Given an ordinary report (no merge in progress), when it runs, then it performs no merge-authorization pull request lookup and no authorization fetch; given a base-merge report (a merge in progress), when it runs, then it performs both the authorization lookup and the authorization fetch, even with COMMIT_PREFLIGHT_FETCH=0, which disables only the reporting fetch; given the authorization lookup or fetch fails, then the report exits non-zero with that failure and prints no report; given a cherry-pick, revert or rebase in progress with no MERGE_HEAD, then the report refuses with the shell's message and exit status, as it does today.
12. AC12: Non-functional: apart from the reporting fetch, the base-merge authorization fetch and the guard mark, the report changes no repository, index or file state; the two fetches keep the effects of today's plain git fetch commands (fetched objects, remote-tracking refs, FETCH_HEAD, automatically fetched tags, reference-log updates and automatic maintenance), and nothing unrelated to them is mutated. Its Go tests pass on macOS, Linux and Windows in CI.

Scope and non-goals

Scope: agentrepo commit preflight and the Go tests ported from the matching preflight Bats cases.

Scope also includes the Go port of the worktree readiness check (worktree-ready.sh), which this child owns; Its port belongs to this child rather than the shared-library area (#321); the #321 body still needs this ownership boundary recorded. Non-goal: switching any shell wrapper to call it, which child 07 does once. Non-goal: unattended-mode details, which child 06 settles. Non-goal: reading machine configuration anew; use the existing readers. Non-goal: changing the report's content beyond what the shell prints.

Approach

This is a strict port: it preserves today's behavior and adds none. Meet AC1 to AC12 with failing cases first: golden report files captured from the shell on fixed fixtures, then Go output compared byte for byte. Reuse the state reading and merge authorization from child 01. The context check is called unconditionally, as the shell does at packages/agents/source/skills/commit/shared/scripts/preflight.sh:108: its cherry-pick, revert and rebase refusals stay unconditional, because they precede the merge check at packages/agents/source/lib/agent.sh:75. Only the merge-authorization network activity (lookup and fetch) depends on a merge being in progress, per the early return at packages/agents/source/lib/agent.sh:78.

Dependencies

Blocked by: #850.

Prerequisites: the configuration readers delivered by #321, and merge authorization from child 01.

Size

M. One pull request.

Verify plan

• AC1, AC2, AC4, AC9: golden-report comparison tests over scratch repositories.
• AC3: golden-report cases with the reporting fetch disabled, failing and timing out against a stub remote.
• AC5, AC6, AC7, AC8, AC10: table-driven tests with stub tools and configuration fixtures, reusing the identity cases in tests/skills/commit/scripts/commit-workflow.bats and tests/skills/agent-commit/workflow.bats; AC10's untrusted-configuration and commit-style cases come from the worktree readiness check's own Bats cases.
• AC11: a 2x2 of ordinary report and base-merge report against reporting fetch enabled and COMMIT_PREFLIGHT_FETCH=0, with stub gh and git recording calls and asserting distinct counts: ordinary report, 0 lookups and 0 authorization fetches in both settings; base-merge report, 1 lookup and 1 authorization fetch in both settings, with the reporting fetch (one more fetch, enabled only) counted separately. These call-count assertions are new coverage; no existing case measures the counts. The behavior preserved is the early return at packages/agents/source/lib/agent.sh:78. tests/skills/commit/scripts/commit-workflow.bats:49 (unborn HEAD, unusable origin, reporting fetch disabled) is ordinary-report evidence only. Unattended and attended base-merge preflight behavior is evidenced by tests/skills/agent-commit/base-merge.bats:81 and tests/skills/agent-commit/base-merge.bats:95. Plus cases where the lookup or fetch fails, and cases for an interrupted cherry-pick, revert and rebase each without MERGE_HEAD, asserting the shell's refusal message and exit status and zero authorization calls.
• AC12: the CI matrix run for the new package, and tests that diff the repository and index state before and after each of the four runs above, excluding only the effects of the two plain git fetch commands (fetched objects, remote-tracking refs, FETCH_HEAD, automatically fetched tags, reference-log updates, automatic maintenance) and the guard mark. A fixture advances a remote-tracking ref and fetches a reachable tag, and the diff must show both changes as the only fetch effects.
• Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification. D2 an independent review approves the exact merged head, and every finding has a recorded disposition. D3 required checks pass with no gate loosened. D4 the leak scans the repository specifies are clean, and every post made for this work passes the per-post leak review before it is posted. D5 every commit is signed. D6 the documentation matches the change or the Verification says why there is no impact. D7 every commit has an Assisted-by trailer and the pull request has the provenance:agent-assisted label. D8 the pull request stays within the size limits. D9 follow-ups are filed as issues and listed under Related. D10 the merge closes the issue through a closing reference, the board shows Done, and the final Status: comment names the merge commit.

Risks

Agents read this report as their picture of the worktree, so a changed line shape could mislead them. Golden comparison is the control. Undo: revert the change; no caller uses the subcommand until child 07.

Operator authority

None.