Standardize tooling - #22

Resolve each `go tool` dependency to its latest release. The repository
checks with these tools in CI, so a stale tool can hide a finding that
the current release reports.

Change-Id: Idf3fa2701336aca051e84517d81c43e14e4c1ac4

Each repository installs its hk Git hooks with `mise run setup`. The
`install-hooks` alias gives a second name for the same task. Remove it
so one name works in every repository.

Change-Id: I9793f69671d7ddb68867fdf946e85c4960533a2a

Name the mise tasks after hk's commands: `fix`, `check`, and `test`.
Remove the `fixers`, `linters`, `tests`, `ci-tests`, and
`static-analysis` aliases so each task has one name.

Change-Id: I3c8697481a3704870d91fca12d705c325d83dfce

The next commit uses the builtins in hk-config, and that package
targets hk 2.10.0. The config and the builtins must amend the same
hk version, because steps built against different versions are
different Pkl types.

Set `minimum_release_age` to zero so that mise installs the newest
release of each tool at once, as the other repositories do.

Change-Id: Id22060a3d78e9d9fe6fff7db493b638f3bf81516

testifylint moves from `go tool` to a mise tool, so the next commit
calls the bare command like every other step.

The fork has no tags, so mise resolves a pseudo-version. That needs
`minimum_release_age = "0"`, which this repository sets.

Change-Id: Ic431179ec287d010d90775f207e880c14710e2d2

The hk-config package holds the hk builtins that this repository needs
beyond hk's own: `goimports -local`, high-severity-only gosec,
testifylint, and steps for the tools that hk does not ship.

Amend that package's config so the config and the builtins share one
hk version. Keep the step that no package can supply: `constable`
runs this working tree.

Declare the steps at the top level and let hk create the `check`,
`fix`, and `pre-commit` hooks, so only the `commit-msg` hook needs
declaring. gitleaks scans the working tree, and a top-level exclude
keeps every testdata fixture out of every step. No step depends on
another: the steps that run in parallel are independent.

Change-Id: I873d80602f02bdf518c1e85c63f817ae86302de6

mise 2026.8.5 cannot resolve the bare `hk` tool name, so `mise
install --locked` stops before it installs any tool. The registry
entry for `hk` arrives in a later mise release, and 2026.10.21
resolves every tool in `mise.lock`.

`mise.lock` was written by 2026.10.21, so CI now installs the tools
with the same version that produced the lock.

Change-Id: I12ad67a72fa5235c927fe3685339157d3841d3ce

`jdx/mise-action` moves from v4.2.5 to v5.2.5, and
`actions/create-github-app-token` moves from v3.2.0 to v3.3.0.
`actions/checkout` stays at v7.0.1.

A full commit SHA with a trailing tag comment keeps the pin
reviewable: the tag names the release, and the SHA is the exact code
that the release pointed to.

Change-Id: I3dbfa60e65b86de7556dde61b8b1103b40487f67

mise 2026.10.21 is no longer the latest release, and its lockfile
handling has moved on since this repository wrote `mise.lock`. CI
now installs the tools with the current release.

mise-action v5 delays a tool download until the release is 24 hours
old, but an explicit `version` skips that delay. No other input
changes.

Change-Id: I4fb9958e172dace20586b42425a86dd31e8a349b

A test that passes on Linux can still fail on macOS, and this project
builds and tests with the Go toolchain that each runner installs.
Running the suite on both operating systems reports a failure on the
platform it affects.

A pinned image such as `ubuntu-26.04` keeps a run reproducible. A
`-latest` label changes the image under the job without a commit.

Change-Id: Ibc0c0f2c0fba3667d2d77bf45c8c10288541538f

`permissions: {}` grants no workflow-level permission. Each step asks
for what it needs through the app token, so an empty set is more
restrictive than `contents: read`.

`runs-on: ubuntu-26.04` names an image, so a run does not change when
a `-latest` label moves.

The `HOMEBREW_GITHUB_API_TOKEN` variable was for a rate limit that a
public repository does not reach, so the step no longer passes it.

Every formula in the tap downloads `archive/refs/tags/<tag>.tar.gz`,
so the second `grep` for `/tarball/<tag>` can never match.

The `concurrency` group already read `update-tap`, so it is unchanged.

Change-Id: Ie988aa818957eff8ef44fcfff8ff7ec82350183d

Every tool in the block is installed by mise and called by its bare
name, so `go tool` builds a second, unused copy of each tool. Only
`go tool cover` remains, and the Go toolchain ships it.

With the block gone, `go mod tidy` drops the tool-only modules from
the dependency graph, so a `go` directive or dependency bump no
longer resolves versions for tools that nothing runs.

Change-Id: I53ca2949994054b63a3b1901e5e7d6a9f64d27d8

mise installs Go 1.27.3, and the `go` directive names the version that
the code requires. A patch-level directive keeps the requirement and
the toolchain in step, as timber does.

Change-Id: Ibcfa875fe672f0aafafcd1deb87286783a3f89ae

The other repositories ignore the same paths, so a file that one
repository generates is ignored in every repository.

`tmp/` replaces `/tmp/`: the pattern now matches a `tmp` directory at
any depth, not only at the root. `.tmp/` and `/constable` cover the
scratch directory and the binary that a local build writes.

Change-Id: I417d2091edb401fef460e5ca2379c75c775e7962

Reorder the `[tools]` keys and the hk steps.

The refactoring type is reordering. A sorted list changes no
behavior: it only makes each entry easier to find, and it gives a new
tool or step one correct place.

Change-Id: I41387a5c3c2004b1832513e2feb68e37583e478f

Rename the check step and reorder two `gh pr merge` flags.

The step name and the flag order change no behavior: a step name is a
label in the run log, and `gh pr merge` reads its flags in any order.

Change-Id: Ie41abb1b57bfbfc2f82d60dd8902a91f0a7bd415

`cover` is the remaining second name for a task. Every other alias is
gone, and one name per task is what this repository standardized on.

The review asked for this alias to go with the others.

Change-Id: I2090ce16c2066646360d9196fb31815235dea6b6

The other two repositories name this step `Run check`, and the job
runs `mise run check`. One name in every repository makes the run log
easy to compare.

Change-Id: I6b82aeb141061fd4014710a310c1431bcb773bba

The skill lives at `skills/constable/SKILL.md`, which is the layout
that the other repositories use. A directory per skill lets a later
commit validate each skill as a unit.

The file content does not change.
Change-Id: Ibae2f81ed38e0a151ddd3ecda0b3c45ab8ced551

The two hk builtins find whitespace at the end of a line and a missing
final newline, and both can fix them.

`hk fix --all` rewrote no file, so this commit adds the steps only.

Change-Id: I9310839f4f37d00ee75dc211c7cafc97fe665186

The release adds the `skills_ref` builtin, so the config and the
builtins still amend one hk version and no step changes yet.

Change-Id: I671c266e65c3a2c7943d534840548438c820f01a

The builtin runs `agentskills validate` on the directory of each
`**/SKILL.md`. It replaces the hand-written `lint-skills` task, so
one shared copy holds the command, the glob, and the tests that
protect it.

`agentskills-tools` comes from PyPI. mise's PyPI backend runs uv, and
uv supplies its own interpreter, so the tool needs no Python entry in
`[tools]`.

Change-Id: Iea5eabfc7868b6c120b190a6029eb71d9e9c438c

CI detects `mise.lock` and runs `mise install --locked`. A locked
install reads the tool's dependency graph from `mise.lock`, so the
`uv = { path = ... }` entry and the `.mise/locks` files it names must
be in the repository. Without them the install stops with "no uv
dependency graph".

Building that graph also needs a Python interpreter, and a runner
image does not supply one that mise can use. So `[tools]` names
Python 3.13, which the lock resolves to one exact release.

An unlocked install needs neither. A locked install needs both.

Change-Id: I86a146fedfc4caaa38d59cd7251940b936020fda

CI reads the PyPI tool's dependency graph from `mise.lock`, and a
dependency lock needs uv 0.12.10 or newer. A runner image does not
carry one, so `[tools]` now names `uv`.

`mise lock` records uv 0.13.6 in `mise.lock`, the same way it records
the other tools.

A locked install of this PyPI tool needs the graph, an interpreter,
and uv. This commit supplies the last of the three.

Change-Id: I87e4ee96a6b46dcf57d3e8e2f2855deae3aad239