fix(cli): record platform-verified repo-lane check evidence in receipts

[islahuddinn]

Summary

Repo-lane receipts always shipped checks: [] because nothing outside the agent wrote .agent-sdlc/checks.jsonl. At the same time, agents could forge source: "platform" by writing self_reported: false into that workspace file.

This PR fixes both issues together:

1. Repo lane receipts always ship checks: [], nothing writes .agent-sdlc/checks.jsonl #244 — platform check writer

   • Adds .github/facility/receipts/run-checks.mjs
   • Adds a Record platform-verified check evidence step to all six agent workflows
   • Runs configured checks + node guards/run.mjs outside the agent turn
   • Writes results to $RUNNER_TEMP/facility-platform-checks.jsonl (not agent-writable)

2. checks[].source in the repo lane trusts a field the agent's own bash tool can write #243 — provenance trust

   • collect.mjs reads platform and agent check files separately
   • Workspace checks.jsonl is always reported as source: "agent"
   • Platform temp file is always reported as source: "platform"
   • self_reported is never trusted from agent-writable paths

Fixes #244
Fixes #243

Test plan

• pnpm --filter @theagilemonkeys/facility test (102 passed)
• Receipt tests: forged platform provenance rejected; platform + agent merge verified
• runPlatformChecks records configured checks and guards
• Init e2e: crew workflow includes platform check recording step

Upgrade note

Existing repositories should re-run facility init (or merge the updated workflow templates) to pick up the new platform check step.

Made with Cursor