ci: migrate no-mistakes gate to shared action

[kunchenguid]

Intent

Migrate this repository's no-mistakes gate to the shared require-no-mistakes composite action, replicating the exact pattern already merged in rough-cut-axi PR #4 (which is the proven template for this migration).

Specific requirements:

1. .github/workflows/no-mistakes-required.yml: replace the entire inline gate run: step with a thin caller step using kunchenguid/no-mistakes/.github/actions/require-no-mistakes@32d396ac0f29135daf7fcb9964aba9d5f4e796d6 (post-v1.57.1, untagged; the action was added in no-mistakes #819). Keep EXACTLY as-is: the job name PR must be raised via no-mistakes, the job-level if: author exemptions, concurrency, permissions, and this repo's paths-ignore release-please exclusion. The enforcement logic (signature check, attestation parse, head-binding) now lives in the shared action - deliberately do NOT keep a local copy. The pin is an immutable commit SHA and never @main, because main is editable by the very PR the gate judges; bumping the pin is a separate deliberate PR.
2. on.pull_request.types: set to [opened, edited, reopened], DROPPING synchronize. This was verified: this repo's ruleset is advisory with NO required status check, so dropping synchronize cannot wedge a merge on 'Expected - waiting for status'. The rationale is that the verdict is a pure function of pull_request.body, so a push carries no new body to judge but does move the head SHA, and a synchronize could pin a FAILURE check run to a head whose body the same pipeline run was about to fix.
3. Remove the now-dead gate-script test test/no-mistakes-gate.test.ts. It called extractGateScript() on the inline run: block at module init and executed it; with the inline block gone it would throw on import. rough-cut-axi chore(main): release gh-axi 0.1.6 #4 deleted its equivalent tests outright rather than replacing them with a workflow-shape test, and the equivalent enforcement tests now live upstream beside the shared action - so deletion with no local replacement is the intended handling here, not an oversight or a coverage regression.
4. Fix AGENTS.md: the old note instructed agents to hand-copy the gate block from a sibling repo and pointed at the deleted test. That hand-copy drift is exactly what this migration kills. Replace it with a note pointing at the shared action, the immutable pin discipline, and what this repo still owns.
5. IMPORTANT (captain decision): the shared action's last-wins verdict semantics are INTENDED. Relaxing the stricter local inline jq (which required every duplicate record of a step to be completed, and failed closed on skip-shaped sibling keys) to the shared action's behavior is CORRECT, not a regression. Do not try to preserve the extra strictness or re-add a local enforcement copy.

Deliverable is one PR raised through no-mistakes (this repo's own gate requires the no-mistakes signature plus attestation, so a direct PR would fail it). Do not merge - the captain merges the public repos.

What Changed

• Replace the inline no-mistakes gate with the shared composite action pinned to an immutable commit, while preserving repository-owned workflow settings.
• Drop the synchronize trigger, remove obsolete inline-script tests, and update contributor guidance to point enforcement changes upstream.

Risk Assessment

⚠️ Medium: The migration matches the required shared-action pattern, but its agent documentation overstates the stale-head enforcement that remains after intentionally dropping synchronize.

Testing

Targeted tests passed, workflow semantics match the migration contract, and the pinned shared verifier accepted compliant and intended last-wins attestations while rejecting a stale head binding.

Evidence: End-to-end shared gate transcript

Source: End-to-end shared gate transcript

$ normalized workflow and composite-action contract check
PASS: opened/edited/reopened only; repo-owned paths, permissions, concurrency, job name and exemptions are unchanged; one pinned shared composite-action step invokes its verifier.

$ pinned shared action with a valid GitHub pull_request event
Found no-mistakes signature in PR #42 body.
Found structurally compliant pipeline step attestation.
::warning::PR-body attestation is author-editable and is not cryptographic proof that no-mistakes produced it.
exit=0
exempt=false
compliant=true

$ pinned shared action with intended duplicate-step last-wins semantics
Found no-mistakes signature in PR #42 body.
Found structurally compliant pipeline step attestation.
::warning::PR-body attestation is author-editable and is not cryptographic proof that no-mistakes produced it.
exit=0
exempt=false
compliant=true

$ pinned shared action rejects a stale head-bound attestation
::error::Pipeline attestation head_sha does not match the current PR head.

attestation.head_sha: older
PR head: abc123

A later push must not pass on an older attestation. Re-run 'git push no-mistakes' so the PR body attestation binds to the current head.

See CONTRIBUTING.md for setup and the full workflow.

PR author: contributor
Found no-mistakes signature in PR #42 body.
exit=1
exempt=false
compliant=false
exempt=false

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

⚠️ **Review** - 1 warning

• ⚠️ AGENTS.md:95 - The claim that a stale head-bound attestation "goes red" is no longer generally true after removing the synchronize trigger. A compliant PR at head A can be pushed directly to head B without rewriting its body; no configured event runs this workflow, so the shared action cannot reject the stale attestation. Qualify this statement to apply only when a body-bearing workflow event runs.

✅ **Test** - passed

✅ No issues found.

• pnpm exec vitest run test/release-ci-exclusions.test.ts
• Parsed the current and base workflow YAML with yaml to verify trigger semantics, preserved repository-owned settings, and the single immutable shared-action caller
• Fetched the action and verifier at commit 32d396ac0f29135daf7fcb9964aba9d5f4e796d6 and executed valid, duplicate-step last-wins, and stale-head pull request events

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.