feat: Add waza gate command for CI regression gates (#364)

[spboyer]

Closes #364

Summary

Adds a new waza gate subcommand that compares a baseline results.json against the current run and returns stable exit codes so CI systems can branch on the exact failure class.

Exit code contract

Code	Meaning
0	Pass — no regressions, no golden failures, task-set policies satisfied
1	Aggregate pass rate dropped beyond --max-regression-pct, or a task-set policy fired with fail
2	A task with golden: true failed (takes priority over 1)
3	Configuration error (bad flags, missing or unreadable files)

Flags

Flag	Description	Default
--baseline <path>	Baseline results JSON	required
--current <path>	Current results JSON	required
--max-regression-pct <N>	Fail if aggregate pass rate drops by more than N pp	0
--golden-must-pass	Hard-fail on any golden task failure	true
--on-new-tasks <p>	allow / warn / fail for tasks in current but not baseline	allow
--on-removed-tasks <p>	allow / warn / fail for tasks in baseline but not current	warn
--format <fmt>	human / json / markdown / github-actions	human
--summary-file <path>	Markdown summary path (auto-set to $GITHUB_STEP_SUMMARY with github-actions)	none

Golden tasks

New golden: true field on TestCase, propagated through TestOutcome. Skill authors mark tasks the build must never regress:

tasks:
  - id: smoke-test
    name: Must always work
    golden: true
    inputs:
      prompt: "..."

GitHub Actions integration

The github-actions format:

• emits ::error:: / ::warning:: workflow commands on stderr (so they still surface when stdout is captured),
• appends a markdown report to $GITHUB_STEP_SUMMARY,
• so failures appear in the PR Files Changed view and the workflow summary without any extra wiring.

Files changed

• New: cmd/waza/cmd_gate.go — command, four renderers, exit-code error type
• New: cmd/waza/cmd_gate_test.go — 15 tests covering all exit codes, all renderers, golden priority, task-set policies, YAML round-trip
• Modified: internal/models/testcase.go, internal/models/outcome.go — add Golden bool field
• Modified: internal/orchestration/runner.go — propagate Golden into three TestOutcome construction sites
• Modified: cmd/waza/main.go, cmd/waza/root.go — wire gateExitError and register the command
• Docs: README.md, site/src/content/docs/reference/cli.mdx, site/src/content/docs/guides/ci-cd.mdx, site/src/content/docs/guides/eval-yaml.mdx

Verification

• go build ./... — ✅
• go test ./... — ✅ (all packages, 15 new gate tests pass)
• make lint — ✅ (no new issues; the 6 remaining SA5011 warnings in internal/mcp/coverage_test.go are pre-existing on main and unrelated to this PR)
• go run ./cmd/waza gate --help — ✅ renders correctly

[Copilot]

Pull request overview

This PR adds a new waza gate subcommand to support CI regression gating by comparing a baseline results.json to a current run and returning stable, machine-branchable exit codes. It also introduces a golden: true task attribute that propagates into result JSON so golden failures can hard-fail the gate, and updates docs to describe the new command and YAML field.

Changes:

• Add waza gate command with multiple output renderers and stable gate-specific exit codes.
• Add golden support to the eval task model (TestCase) and propagate it into TestOutcome results.
• Document waza gate usage and golden in README and the site/ docs.

Show a summary per file

File	Description
site/src/content/docs/reference/cli.mdx	Adds CLI reference docs for waza gate including flags and gate-specific exit codes.
site/src/content/docs/guides/eval-yaml.mdx	Documents the new golden task field and its effect on waza gate exit codes.
site/src/content/docs/guides/ci-cd.mdx	Adds CI examples (GitHub Actions/Azure DevOps/GitLab) showing how to run waza gate.
README.md	Adds a top-level README section describing waza gate, flags, exit codes, and YAML example.
internal/orchestration/runner.go	Propagates TestCase.Golden into TestOutcome creation paths.
internal/models/testcase.go	Adds Golden bool with YAML/JSON tags for task definitions.
internal/models/outcome.go	Adds Golden bool to TestOutcome JSON so results carry the golden marker.
cmd/waza/root.go	Registers the new gate command with the root CLI.
cmd/waza/main.go	Adds gate-specific exit code mapping via gateExitError.
cmd/waza/cmd_gate.go	Implements waza gate logic, report building, renderers, and exit code contract.
cmd/waza/cmd_gate_test.go	Adds tests covering gate exit codes, policies, formats, and YAML round-trip for golden.

Review details

• Files reviewed: 11/11 changed files
• Comments generated: 3
• Review effort level: Low

[spboyer]

Superseded by #384, which lands the full waza gate command from the orchestrated implementation session, also absorbs #359 (golden task field), and uses conservative golden detection to handle baselines without the field. Closing as duplicate.