feat(ci): rivet-driven verification gate + sticky PR comment

[avrabe]

Summary

Makes artifacts/verification.yaml executable rather than purely descriptive. A new CI job runs every type: feature artifact's fields.steps[].run commands and posts a sticky PR comment with pass/fail counts + failed artifact IDs.

The PR comment looks like:

Rivet verification gate

✅ 177/177 passed

	count
Passed	177
Failed	0
Skipped (no steps)	0

Filter: (and (= type "feature") (has-status "passing"))

On failure, the same comment lists the failing artifact IDs in a <details> block.

What's in this PR

• tools/run_verification.py — Python (stdlib only). Calls rivet list + rivet get, executes each step under bash -c, writes verification-results.json. Same script runs locally for fast feedback.
• tools/post_verification_comment.py — finds the marker comment via gh api and PATCHes the body; creates new only on first run. No comment spam across re-runs.
• .github/workflows/verification-gate.yml — new CI job on PRs. Per-PR filter override: add Verify-Filter: <sexp> to the PR body.
• artifacts/verification.yaml: quote cargo test ... enumerate:: step commands (line ~1615) — unquoted trailing :: made rivet silently skip the whole file. Pre-existing parse error blocking the new gate.
• artifacts/{requirements,verification}.yaml: REQ-VERIFY-GATE-001 + TEST-VERIFY-GATE-RUNNER documenting the new capability.

Local use

# all feature artifacts:
tools/run_verification.py
# v0.9.x closeout subset only:
tools/run_verification.py --filter '(and (= type "feature") (has-tag "v093"))'
# self-test:
tools/run_verification.py --filter '(and (= type "feature") (has-tag "classifier-match"))'

Security note

The PR-body filter override (Verify-Filter: <sexp> in the PR description) is passed via env-var indirection (env: PR_BODY: ${{ github.event.pull_request.body }} + printf '%s' "$PR_BODY"), not direct ${{ }} interpolation in the run: block. This prevents the classic script-injection attack where a malicious PR body executes arbitrary commands on the runner. The security-reminder hook caught the original draft and flagged it.

Test plan

• Local smoke test passes: tools/run_verification.py --filter '(and (= type "feature") (has-tag "classifier-match"))' runs 1 artifact, emits clean JSON, exits 0
• rivet validate passes
• Workflow runs on this PR (will produce the first sticky comment as a meta-demo)
• CI green

Co-Authored-By: Claude Opus 4.7 noreply@anthropic.com

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

Rivet verification gate

✅ 13/13 passed

	count
Passed	13
Failed	0
Skipped (no steps)	0

Filter: (and (= type "feature") (or (has-tag "v093") (has-tag "v0100")))

Failed artifacts

(none)

_{Updated automatically by tools/post_verification_comment.py. Source of truth: artifacts/verification.yaml.}