fix(ci): dogfood calm-guard-dogfood against this commit, not stale npm

Root cause of the real CI failure on 887c2f0: action.yml's default
`version: latest` installs whatever's last published to npm (0.5.0),
but `guard` landed in 9773d41 -- AFTER that npm tag -- so the dogfood
job 404'd on `error: unrecognized subcommand 'guard'`. Any external
user following README's one-line-CI instructions right now hits the
same wall; this only fixes the CI symptom, not that underlying gap
(tracked by not yet cutting a new release -- see below).

calm-guard-dogfood now builds calm-cli from source and aliases it as
`calm-mcp` on PATH (skip-install: true), so it dogfoods the actual
commit's own wiring instead of a release that may not contain it yet.
action.yml gains a `skip-install` input for this exact pattern.

Also bumps workspace version 0.5.0 -> 0.6.0 (Cargo.toml,
plugins/calm/.claude-plugin/plugin.json) in preparation for the next
release -- this commit does NOT tag or trigger release.yml. Release is
intentionally deferred: `calm fitness-check`'s hotspot_risk gate fails
on this exact commit (crates/calm-server/src/tools/common.rs, 0.95 vs
0.80 max -- same file split once before at 81f7315 for the same gate,
since regrown). A same-session attempt to re-split it hit this repo's
own high-risk edit-safety gate (>10-caller hub, requires a live
elicitation approval); the elicitation round-trip was tested twice
this session and both times auto-declined fail-closed (no approval UI
in this environment) -- confirmed not a timing issue by retrying with
elicit_timeout_secs raised to 120s. Splitting common.rs properly is
left for a session with real human-reviewed-PR capability rather than
routing around the gate.

Full workspace verification (fmt --check, clippy --workspace
--all-targets -D warnings, cargo test --workspace incl. calm-server
--lib 341/341) green on this exact commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Your Name

.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
   # it's run clean across enough real PRs.
   calm-guard-dogfood:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 15
     continue-on-error: true
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -51,7 +51,30 @@ jobs:
           # fallback it's meant to be testing.
           fetch-depth: 0
 
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+
+      # Dogfooding must exercise THIS commit's own calm-cli, not whatever
+      # was last published to npm -- action.yml's default `version: latest`
+      # install can lag a real subcommand by days (found for real: `guard`
+      # landed in 9773d41, after the v0.5.0 npm tag, so the plain npm-install
+      # path 404'd on `error: unrecognized subcommand 'guard'` here until
+      # this fix). Building from source and aliasing it as `calm-mcp` on
+      # PATH, then passing skip-install: true, tests the actual wiring this
+      # PR/push is changing instead of a stale release.
+      - name: Build calm-cli from source (this commit, not the last npm release)
+        run: cargo build -p calm-cli
+
+      - name: Alias the freshly built binary as calm-mcp on PATH
+        run: |
+          mkdir -p "$HOME/.local/bin"
+          ln -sf "$GITHUB_WORKSPACE/target/debug/calm" "$HOME/.local/bin/calm-mcp"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
       - uses: ./
+        with:
+          skip-install: true
         # No `base`/`commits` input -- exercises action.yml's own
         # pull_request/push auto-detection, not an explicit override.
 

Cargo.lock

@@ -17,7 +17,7 @@ members = [
 # version against the downloaded release binary's real `--version` output
 # and treats any mismatch as a corrupted/wrong download, so a stale value
 # here silently defeats the verified-download fast path for everyone.
-version = "0.5.0"
+version = "0.6.0"
 edition = "2024"
 license = "MIT"
 rust-version = "1.85"

Cargo.toml

@@ -45,11 +45,23 @@ inputs:
     description: 'Which @eilodon/calm-mcp npm version to install. Defaults to the latest published release.'
     required: false
     default: 'latest'
+  skip-install:
+    description: >-
+      Skip the npm install step and use whatever `calm-mcp` is already on
+      PATH. For dogfooding this action against a not-yet-released commit
+      (build calm-cli from source, put a `calm-mcp`-named symlink to it on
+      PATH, then call this action with skip-install: true) -- see
+      .github/workflows/ci.yml's calm-guard-dogfood job for the pattern.
+      Most callers should leave this false and let npm install a real
+      published release.
+    required: false
+    default: 'false'
 
 runs:
   using: 'composite'
   steps:
     - name: Install calm
+      if: inputs.skip-install != 'true'
       shell: bash
       env:
         CALM_VERSION: ${{ inputs.version }}

action.yml

@@ -1,7 +1,7 @@
 {
   "name": "calm",
   "description": "CALM (Coding Agent Liveness Map) MCP server — call-graph-aware locate/source/edit_symbol/diff_impact and 37 tools total, backed by a multi-tier resolver (syntactic -> Stack Graphs -> SCIP) instead of grep. Bundles a SessionStart bootstrap (scaffolds the CALM tool-workflow hook + AGENTS.md into your project on first use, via `calm init --hooks --agents-md`) and a calm-guide Skill.",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "author": {
     "name": "Eilodon"
   },