chore(ci): single source of truth for the validation gate set

[ben-laird]

deno task verify and .github/workflows/dv-validate.yml were two hand-maintained lists of the same gates — and they had drifted. verify omitted doc:lint (and it was easy to miss publish:check's output), so a public-API change could pass locally and fail in CI. That's exactly what bit the #19 freeze (SCHEMA_URNS tripped both publish:check and doc:lint only in CI).

The fix

A new apps/cli/src/scripts/ci.ts is the single source of truth for the gate set — one ordered list, run as subprocesses (output buffered, shown only on failure), fail-fast. Both entry points point at it:

• deno task verify → runs the script
• the validate workflow → its ~dozen steps collapse to one deno task verify

Add or remove a gate in ci.ts and both local and CI pick it up. They can no longer diverge.

Coverage (now identical in both places)

fmt:check · lint · check · test · schemas:check · publish:check · doc:lint · dv validate · dv plugin verify (deno / npm / dv-release) · docs build

The dv-specific gates invoke apps/cli/src/main.ts directly, so CI no longer needs the separate "install dv from source" shim step.

Sample output

▸ fmt:check                          ok     (74ms)
▸ lint                               ok     (140ms)
▸ check                              ok     (422ms)
▸ test                               ok     (22.8s)
...
▸ docs build                         ok     (1.6s)
verify passed (12/12 gates, 26.1s)

On failure it stops at the first failing gate and dumps that gate's stdout/stderr.

Docs updated (CONVENTIONS.md, apps/cli/CLAUDE.md) to point at verify as the one command to run before calling work done. Infra-only — no Record.

🤖 Generated with Claude Code