[Juanmadiaz45]

What changes

Adds a guard step to stack-tests.yml that fails visibly when a caller's stack-command is empty or blank, before the gate step executes. Also adds tests/workflows/stack-tests-contract.bats, the first automated contract coverage for this workflow.

Why

Investigating gitops spec 007 T027 (verify "enabled-but-empty fails visibly" once per gate) after already finding and fixing the identical defect in ci.yml's test-command (gitops spec 003 T024, PR #27): stack-command has the exact same shape -- required: true, no default, silently satisfiable by an empty string, and run: ${{ inputs.stack-command }} with an empty value succeeds having run no e2e/perf/dast/pact/conformance gate at all. This workflow backs five separate gates across the frontend repo (e2e, perf, dast, pact, conformance), so the blast radius of a caller accidentally leaving stack-command empty was larger than the one already fixed.

Confirmed live on real GitHub Actions before the fix (disposable draft PR, closed without merging): a probe run with stack-command: "" against a minimal one-service compose stack succeeded. After this fix (disposable draft PR #28, closed without merging): the same input fails at the new guard with "Reject an empty stack-command": conclusion "failure" and "Run probe gate": conclusion "skipped".

Tasks

• gitops specs/007-advanced-testing T027 (delivered -- see this repo's evidence in the linked gitops PR)

• The task register is updated in the linked gitops pull request

• Every task ticked there was verified by locating its artifact

How it is verified

• tests/workflows/stack-tests-contract.bats (new file) fails before the guard exists and passes after, following the SDD test-then-feat pair.
• actionlint .github/workflows/stack-tests.yml is clean.
• Live re-verification on real GitHub Actions: disposable draft PR DISPOSABLE: verify empty stack-command fix (T027, not for merge) #28 with stack-command: "" against a minimal redis:7-alpine-only compose stack now fails at the new guard step with ::error::stack-command must not be empty or blank -- an empty run: step succeeds having run no probe gate (FR-017: a gate must fail visibly, never pass silently), and the gate step itself is correctly skipped. Closed without merging once observed.
• Infrastructure documentation: this is a GitHub Actions workflow change, not Terraform/AWS/Azure; no required MCP server applies to this specific change.

Risk and rollback

Low: adds one guard step; every existing caller (frontend's e2e/perf/dast/pact/conformance workflows) already supplies a real, non-empty stack-command, so no caller is currently affected. Rollback is reverting this commit.

What this PR does not do

Does not change compose-file or ready-command, which are legitimately optional (default: "") and already if:-guarded to skip visibly when unset -- only stack-command is required: true yet was silently satisfiable by an empty string, exactly like ci.yml's test-command before PR #27.