feat(cmd): wire --agent flag into new/yolo/yolo!/safe #70

	# PR + non-main-push gate. Runs the Go build + tests the release
	# pipeline depends on, so a broken main is caught before merge instead
	# of after.
	#
	# Scope intentionally narrower than `make regression`: `govulncheck` is
	# heavier and currently runs via `make regression` locally — adding it
	# here is a follow-up if/when it proves necessary as a merge gate.

	name: CI

	on:
	pull_request:
	push:
	branches-ignore:
	# main is covered by release.yml; skipping here avoids running the
	# same checks twice on every merge.
	- main

	permissions:
	contents: read

	concurrency:
	group: ci-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	build-and-test:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Set up Go
	uses: actions/setup-go@v5
	with:
	go-version-file: go.mod

	- name: Go vet
	run: go vet -tags sqlite_fts5 ./...

	- name: Go build
	run: go build -tags sqlite_fts5 ./...

	- name: Go test
	# -race: Go's runtime data-race detector. Instruments memory
	# accesses across goroutines and panics on a detected race —
	# the realistic dynamic-analysis tool for a goroutine-heavy
	# CLI that shells out to tmux. Satisfies the OpenSSF Best
	# Practices `dynamic_analysis` and
	# `dynamic_analysis_enable_assertions` criteria.
	run: go test -tags sqlite_fts5 -race ./...

Provide feedback