Validate the draft's sections, comments, fences and paths from agentrepo pr #912

Problem

The second half of validate-description.sh judges the draft body against the template: sections missing, out of order or empty, a Verification section naming no command, instructional comments and placeholders left behind, link placeholders, unclosed fences, a missing compatibility declaration for consumer-facing changes, and backticked paths that exist neither in the tree nor in the branch diff. Until it moves, the shell validator cannot be replaced and lint-pr-description cannot run from Go alone.

Part of #588 and #323. Delivers in Go the behavior of the section, comment, fence, link, compatibility and path rules of packages/agents/source/skills/pr/shared/scripts/validate-description.sh, completing the Go validator with child 02. This change adds Go behavior only and removes no shell: the shell validator stays whole, frozen, until child 12 forwards to Go.

Acceptance criteria

1. AC1: Given a draft missing a template section, when it is validated, then section-missing is reported at the anchor line naming the template that supplied the requirement.
2. AC2: Given sections present but reordered, when it is validated, then section-order names the first wrong section, distinct from the missing case.
3. AC3: Given a section with no content, when it is validated, then section-empty is reported, with the provenance note where the shell adds one.
4. AC4: Given a Verification section that names no command, when it is validated, then verification-names-no-command is reported.
5. AC5: Given a surviving template comment, placeholder or link placeholder, when it is validated, then template-comment-left, placeholder-left or link-placeholder is reported on its line.
6. AC6: Given a fence that never closes, when it is validated, then fence-unclosed is reported at the opening line.
7. AC7: Given a branch diff against origin/<base> that changes a path under .devtools/, .config/mise/conf.d/ or packages/agents/, or a vendir.toml, pins.toml or apm.toml at any depth, when the draft is validated, then compatibility-missing is reported on the title line unless the draft's ## Risk section holds a line Compatibility: none or Compatibility: deprecates <key> since <version>; given such a line placed under any other heading, then the finding is still reported; given no listed path changed, then no declaration is required.
8. AC8: Given a template and a draft with 96 extra sections each over 1 KB long, when the draft is valid, missing a section, holding an empty section, or reordered, then the validator reports no finding, section-missing, section-empty or section-order respectively and exits as the shell does, without error from the volume.
9. AC9: Given a backticked path that exists in neither the tree nor the branch diff against origin/<base>, when it is validated, then path-not-found is reported; given a path in either, then it is not.
10. AC10: Given any fixture draft, when the complete Go validator (this child's rules with child 02's) runs, then output and exit status are byte-identical to the shell validator's, and mise run lint-pr-description prints the same for the same draft.
11. AC11: Non-functional: every finding states its line and fix, rules run in the LC_ALL=C collation the shell pins, and the run makes no network connection.

Scope and non-goals

Scope: the remaining rules above and the complete Go validator that combines them with child 02's.

Non-goal: the frontmatter and title rules from child 02. Non-goal: vale, cspell or the template itself. Non-goal: adding a rule. Non-goal: converting the shell validator into a forwarder or deleting any shell, which child 12 does once, together with generation.

Approach

Meet AC1 to AC11 with failing table-driven cases first, reusing the compatibility, section-pipes and workflow fixtures already in the Bats suite, and compare against captured shell output. The package layout is the implementer's choice within those outcomes.

Dependencies

Blocked by: #910, #911, #753.

Prerequisites: the repository configuration reader delivered under #321, and #753 for the protection of new Go enforcement paths.

Size

M. One pull request. The rule group is about 400 non-comment shell lines; with tests and fixtures it is estimated at 600 to 700 changed code lines, with no deletions, no wrapper change and no generated or deployed file in the diff. If the estimate exceeds 700 before the tests are written, the path and compatibility rules (AC7, AC9) move to their own issue.

Verify plan

• AC1, AC2, AC3, AC4, AC5, AC6: Go tests, one table row per rule.
• AC7: Go tests over a scratch repository with a branch diff touching each listed path, a ## Risk line of each accepted form, the same line under another heading, and an unlisted path.
• AC8: Go tests that port the large-section-list cases of tests/skills/pr/scripts/section-pipes.bats (valid, missing, empty and reordered).
• AC9: Go tests over a scratch repository with a branch diff.
• AC10: the parity test over every fixture draft plus a run of mise run lint-pr-description before and after.
• AC11: a test asserts finding format and that no network connection is attempted.
• Go tests run in the existing Go CI on macOS, Linux and Windows.
• Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification. D2 an independent review approves the exact merged head, and every finding has a recorded disposition. D3 required checks pass with no gate loosened. D4 the leak scans the repository specifies are clean, and every post made for this work passes the per-post leak review before it is posted. D5 every commit is signed. D6 the documentation matches the change or the Verification says why there is no impact. D7 every commit has an Assisted-by trailer and the pull request has the provenance:agent-assisted label. D8 the pull request stays within the size limits. D9 follow-ups are filed as issues and listed under Related. D10 the merge closes the issue through a closing reference, the board shows Done, and the final Status: comment names the merge commit.

Risks

Line numbers drift if fences or the frontmatter offset are counted differently, which silently misdirects every fix. The parity test compares line numbers. Undo: revert the change; nothing calls the Go validator yet and the shell validator runs alone.

Operator authority

None.