Gates run in the caller's locale instead of the C locale #928

Problem

The shared skill library and several entry points export LC_ALL=C at the top (packages/agents/source/lib/lib.sh, signing.sh, worktree-ready.sh, and the commit and pull request skills' scripts, for example packages/agents/source/skills/commit/shared/scripts/commit.sh and packages/agents/source/skills/pr/shared/scripts/create-pr.sh), and the repository gates they launch inherit it. Some gates are launched directly by those scripts and not through the library's gate helper. The gate invocation sites at the baseline (fd7b680) are:

• commit workflow: packages/agents/source/skills/commit/shared/scripts/commit.sh (direct mise run calls for leak, secret and lint gates, and the test gate through the helper) and packages/agents/source/lib/agent.sh (the commit-message lint gate).
• pull request workflow: packages/agents/source/skills/pr/shared/scripts/create-pr.sh (direct leak, secret and lint gates, and the test gate through the helper) and packages/agents/source/skills/pr/shared/scripts/pr-agent.sh (the configured title check and the description lint gate).
• merge workflow: packages/agents/source/skills/merge-pr/shared/scripts/merge-agent.sh (the squash-message lint gate, run directly with its own environment) and its callers, which set the locale before reaching it: packages/agents/source/skills/merge-pr/shared/scripts/lint-squash-msg.sh (sets LC_ALL near its top and invokes the helper) and packages/agents/source/skills/merge-pr/shared/scripts/squash-merge.sh (sets LC_ALL near its top and invokes the helper), plus packages/agents/source/skills/merge-pr/shared/scripts/pull-request.sh, which sources the helper.

Any gate that needs a UTF-8 locale fails, for example ansible-lint, which refuses to run under a C locale (#379). The workflow gates must run in the caller's locale, and the C locale must apply only to the library's own text processing.

Part of #588 and #321. Fixes #379.

Acceptance criteria

1. AC1: Given a caller whose environment sets LANG, LC_CTYPE or LC_ALL to a UTF-8 locale, when any workflow gate runs through a commit, pull request or merge workflow entry point (including the merge entry points that reach the squash-message gate through the callers inventoried in the Problem, and the title and description checks of the pull request workflow), whether through the gate runner or by a direct gate call in that entry point, then the gate process sees the caller's original locale variables, with the same precedence among them.
2. AC2: Given a caller with no locale variables set, when a gate runs through those entry points, then the gate process's effective character encoding is UTF-8, observed by the gate reporting its encoding and not only its variables.
3. AC3: Given a gate that reports its effective encoding, LC_ALL, LC_CTYPE and LANG, when it runs after the change under a caller locale of C, a UTF-8 locale, and none, then the reported values match the caller's, or a UTF-8 default when none was set.
4. AC4: Given the library's own collation and character-class processing (sorting, key matching and the digests of the stamp and gate cache key), when the caller's locale differs, then the sorted lists, match results and digest strings are byte-identical to those under the C locale.
5. AC5: Given a consumer binary that lacks the replacement, when the wrapper runs, then it falls back to the frozen shell behavior, which keeps its current locale handling, and the N-2 compatibility policy holds.
6. AC6: Given the generated skills, when mise run generate-skills runs, then the output is regenerated from the canonical sources and mise run check-generated-skills passes.
7. AC7: Non-functional: the Go tests pass on Linux, macOS and Windows in CI.

Scope and non-goals

Scope: the locale handed to gate processes at the gate invocation sites listed in the Problem, in the commit, pull request and merge workflows, and the places the shared library files (lib.sh, agent.sh, signing.sh, worktree-ready.sh) and those entry points export LC_ALL=C, because a sourced export reaches every gate the entry point launches. The merge workflow's squash-message gate is included, so the closing claim for #379 covers it.

Non-goal: changing which gates a skill runs. Non-goal: removing the shell fallback, which a later issue owns. Non-goal: the gate pass cache itself and the deletion of gates.py (#713). Non-goal: loosening the existing locale-pin rule in tools/check-script-hygiene.sh beyond the sites inventoried here.

Approach

Meet AC1 to AC7 with failing cases first. The inventory in the Problem bounds the sites; a site found outside it is added to that list in the pull request. The mechanism is the implementer's choice within those outcomes.

Dependencies

Blocked by: #713 (the Go gate runner, which also deletes gates.py), #753 (golden-file protection for the Go enforcement paths, which must be in place before enforcement callers switch to Go).

Prerequisite: none beyond the generated-skills workflow.

Size

S. One pull request: the inventory lists seven entry points and four library files, and the change stays below 800 lines of code and 2,000 prose lines.

Verify plan

• AC1: tests that run the commit, pull request and merge entry points (the squash-message path through lint-squash-msg.sh and squash-merge.sh, and the title and description checks through pr-agent.sh) against a stub gate that records its locale variables, including a direct gate call, under each caller locale.
• AC2: the same stub reporting its effective encoding with no locale variables set.
• AC3: the stub under C, UTF-8 and unset caller environments, comparing the reported values.
• AC4: a Go test comparing the library's sorted, matched and digest outputs across two caller locales.
• AC5: a Bats case that runs the wrapper against a binary stub without the subcommand and compares with the frozen shell result.
• AC6: mise run generate-skills leaves no diff and mise run check-generated-skills passes.
• AC7: the CI matrix jobs for the Go packages.
• Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification. D2 an independent review approves the exact merged head, and every finding has a recorded disposition. D3 required checks pass with no gate loosened. D4 the leak scans the repository specifies are clean, and every post made for this work passes the per-post leak review before it is posted. D5 every commit is signed. D6 the documentation matches the change or the Verification says why there is no impact. D7 every commit has an Assisted-by trailer and the pull request has the provenance:agent-assisted label. D8 the pull request stays within the size limits. D9 follow-ups are filed as issues and listed under Related. D10 the merge closes the issue through a closing reference, the board shows Done, and the final Status: comment names the merge commit.

Risks

The change touches owner-tier lib.sh, so a wrong locale could change the order of a stamp or cache key (AC4 guards this), and a changed export could alter the frozen fallback's behavior (AC5 guards this). Undo: revert the change, which restores the process-wide C locale.

Operator authority

Owner-only GitHub action: the owner's exact-head review. Owner-tier paths named, with their generated scripts/ copies: packages/agents/source/lib/lib.sh (golden, owner and constitutional), packages/agents/source/lib/agent.sh (golden and owner), packages/agents/source/lib/signing.sh (constitutional) and packages/agents/source/skills/merge-pr/shared/scripts/merge-agent.sh (golden, owner and constitutional), per .agents/agent-skills.conf. The pull request needs the owner's exact-head review at merge.