wayfinder #165: contract lint R1-R5 (guardrail-first)

[EthanThatOneKid]

wayfinder #165 — contract lint R1-R5 (guardrail-first)

Implements the shared credential-free CI/secrets contract lint described in
skills/contract-lint/README.md. Blade scaffold (399ffac, R1 rules list +
exit 0) now does real work.

Rules enforced

Rule	Contract
R1	deploy-* jobs may only fetch CLOUDFLARE_API_TOKEN from Infisical, and only by a named secret-name; the token must never come from a GitHub secret inside a deploy job.
R2	CLOUDFLARE_ACCOUNT_ID must come from GitHub variables, never secrets.
R3	Every Infisical/secrets-action fetch must declare secret-name.
R4	No committed secret-looking literal values in workflow files (real-key patterns; placeholder lines allowlisted).
R5	PR-triggered jobs must not access privileged deployment credentials (CLOUDFLARE_API_TOKEN).

Composite action inputs workflows-dir (default .github/workflows), fails
closed, safe to run on untrusted PRs.

Verification (local, pre-merge)

Ran lint.sh --dir against the three service repos' worktrees — all four
deploy jobs fail exactly as the pre-conversion contract predicts:

• wazoo-api ci.yml: 6 — deploy-qa/deploy-prod each: unnamed Infisical
  fetch (R1), secrets.CLOUDFLARE_API_TOKEN (R1), secrets.CLOUDFLARE_ACCOUNT_ID (R2)
• wazoo-console ci.yml: 9 — deploy-qa/prod same as wazoo-api; deploy-preview
  additionally PR-triggered + token secret (R5)
• worlds-api ci.yml: 4 — deploy-qa/prod token-source (R1) + account id (R2); no
  Infisical fetch in deploy today (Phase B step 9 applies later)
• smoke-qa.yml (all three): clean
• Fixtures: compliant post-conversion workflow passes (0), violation workflow
  caught on all six rules

Merge order / dependents

Workspace-cli lands first. wazoo-api, wazoo-console, worlds-api then
wire this action pinned to the merged SHA in a PR-only contract-lint job.
Those consumer PRs will be red pre-conversion and are held for Phase B.

What I could not observe

• Composite action execution inside an actual GitHub runner
  ($GITHUB_ACTION_PATH resolution). Verified the bash locally only. The
  consumer wiring PRs exercise this on a real runner.
• wspace check states for the worktrees used as lint evidence (snapshots may
  have advanced during the session).

[wazoocomputer]

This pull request introduces a new shared contract lint for Wazoo CI workflows, addressing secrets management and credential access. It defines and enforces five rules (R1-R5) to ensure secure handling of sensitive information in deploy-* jobs and PR-triggered workflows. The lint is credential-free, operating by scanning workflow YAML files, making it safe to run on untrusted pull requests.

File Path	Change Type	Summary
skills/contract-lint/README.md	added	Adds documentation for the credential-free contract lint, detailing its rules and usage.
skills/contract-lint/action.yml	added	Defines the GitHub Action for the contract lint, specifying its description, inputs, and composite run steps.
skills/contract-lint/lint.sh	added	Implements the core logic for the contract lint, including functions to scan for secret-looking literals and analyze job blocks against defined rules.

Reviewers should begin by examining skills/contract-lint/README.md for a comprehensive understanding of the lint's purpose and rules.