Run the commit gates and confirmation from agentrepo commit #853

Problem

The first half of commit.sh checks that nothing moved since the review, lints the draft message, scopes both leak gates to one base, runs the secret scan, the full repository lint and the cached tests, re-runs the review, resolves the confirmation and copies the message. It is a long ordered sequence of refusals under the freeze in #588.

Part of #322, within #588. Child 04 in #322's Children list. Delivers in Go the behavior of the pre-commit half of packages/agents/source/skills/commit/shared/scripts/commit.sh as agentrepo commit, complete up to and including the copied message file. Its public --dry-run keeps today's behavior exactly; the completed pre-write stage is verified at an in-process boundary until child 05 adds the write.

Acceptance criteria

1. AC1: Given an unrecognized flag, when agentrepo commit runs attended, then it refuses with the allowlist (--amend, --confirmed, --dry-run, --rerun-gates) and the received flag; the unattended flag is added to the accepted set by child 06.
2. AC2: Given an empty or missing COMMIT_AGENTMSG, nothing staged on a normal commit, or an amend with no commit, when the command runs, then it refuses with the matching guidance.
3. AC3: Given no stamp, a staged tree changed after the review, a draft edited after the review, or a moved head or merge head, when the command runs, then it refuses and names the review command to run again.
4. AC4: Given an amend, an unborn head or a normal commit, when the leak gates run, then both receive the same staged-mode base: the amended commit's parent tree, the empty tree, or the head tree; given the parent cannot be resolved (a shallow boundary), then it exits 2 with a message that the scan is incomplete.
5. AC5: Given the gates, when they run, then the commit-message lint, the leak scan, the secret scan, the full repository lint and the tests run in that order; the message lint runs the attended command today's shell runs, or in unattended mode the command named by lint_commit_cmd (an empty value refuses), and the full repository lint is never replaced by it.
6. AC6: Given the test gate, when it runs, then it uses the pass cache, --rerun-gates forces a fresh run, and the repository lint is never served from a cache.
7. AC7: Given the gates have passed, when the command continues, then the review runs again, and a refusal there stops the command.
8. AC8: Given --dry-run, when every gate and the second review pass, then the command exits 0 before the confirmation step and before the message is copied, printing the same message text as the shell, and commits nothing; this behavior is pinned by a parity test against the shell.
9. AC9: Given no confirmation from the operator flag, the session pre-approval or the delegation check, when the command reaches the write, then it exits 75 and commits nothing; given a delegation refusal, then it exits 1.
10. AC10: Given the head, index, tree, draft, mode, merge state or trusted-policy authority changed while the gates or the confirmation ran, when the command reaches the write, then it refuses and writes nothing.
11. AC11: Given the copied message differs from the approved draft bytes, when the digest is compared with the stamp, then it refuses.
12. AC12: Given a body line that opens with a number sign, when the message is copied, then the line is kept; and non-functionally, the already-committed HEAD message that is inspected to resolve an amend's parent is never written to a temporary file.

Scope and non-goals

Scope: agentrepo commit through the gates, the second review, the confirmation and the copied message file. Its completion (a verified, confirmed, copied message with no commit made) is checked at an in-process boundary by the tests; no public flag exposes it, and --dry-run is unchanged.

Non-goal: the git commit run, failure diagnostics and post-commit verification, which child 05 delivers. Non-goal: the gate cache, confirmation and stamp implementations, which #321 delivers. Non-goal: any shared commit-message lint helper from #321. Non-goal: switching any shell wrapper, which child 07 does once, so the shell keeps committing until then.

Approach

Meet AC1 to AC12 with failing cases first, porting the matching cases from tests/skills/commit/scripts/commit-workflow.bats and keeping fake mise and git stubs where the suite used them. Use the gate, stamp and confirmation functionality from #321. The mutation cases for AC10 change state while the gates or the confirmation are running, not only before the command starts.

Dependencies

Blocked by: #850, #852.

Prerequisites: the gate execution and cache, stamp and freshness validation, and confirmation deliverables of #321. The message lint step uses the configuration reader already on main.

Size

M. One pull request.

Verify plan

• AC1, AC2: table-driven argument and precondition tests with the exact refusal text.
• AC3: tests that run with no stamp, and that mutate the index, draft, head and merge head between review and commit.
• AC4: tests over scratch repositories including a shallow clone.
• AC5: tests with a fake mise recording the order of calls, and a configured lint command that records its argument and exits non-zero.
• AC6: tests with a fake mise recording cache hits, the forced rerun and repository lint calls, including the cases from agent-pr and agent-commit: reuse a dry run's gate passes on an unchanged tree #161.
• AC7: a test that a second review runs after the gates and that its refusal stops the command.
• AC8: a parity test that runs --dry-run against the shell and the Go command on the same fixture, comparing exit status and message text and showing the confirmation step is never reached.
• AC9: tests with pre-approval, delegation grant, refusal and deferral stubs.
• AC10: tests where a stub gate or confirmation mutates the head, index, draft, mode, merge state and trusted policy while it runs, at the gate stage and at the confirmation stage.
• AC11: a test alters the copied message so it differs from the approved bytes.
• AC12: a test with a leading number sign body line, and an amend test that resolves the parent from the committed HEAD message and lists the temporary files written during the extraction, as tests/skills/commit/scripts/commit-workflow.bats does.
• Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification. D2 an independent review approves the exact merged head, and every finding has a recorded disposition. D3 required checks pass with no gate loosened. D4 the leak scans the repository specifies are clean, and every post made for this work passes the per-post leak review before it is posted. D5 every commit is signed. D6 the documentation matches the change or the Verification says why there is no impact. D7 every commit has an Assisted-by trailer and the pull request has the provenance:agent-assisted label. D8 the pull request stays within the size limits. D9 follow-ups are filed as issues and listed under Related. D10 the merge closes the issue through a closing reference, the board shows Done, and the final Status: comment names the merge commit.

Risks

Reordering refusals could let a write through before a gate. The ordering tests (AC5), the stamp cases (AC3) and the mid-run mutation cases (AC10) are the controls. Undo: revert the change; no caller uses the command until child 07.

Operator authority

None.