[chaksaray]

Closes #58

What and why

Adds the gate half of the pipelines this repo is meant to wire (INT-5): a bawbel-gate lint template for repos that keep capability manifests in git.

• gate-lint/action.yml: composite action, used as bawbel/integrations/gate-lint@v1. It runs the two commands from gate DESIGN.md 11.3 (schema check over manifests/, then the egress rule over manifests/prod).
• examples/gitlab-ci-gate-lint.yml: the same checks for GitLab, settings as GATE_* variables.
• README section "Gate manifest lint", including how to make the job a required check on GitHub and GitLab.
• tests/gate-lint/fixtures/ and .github/workflows/gate-lint-local.yml, which runs the action from the working tree (same idea as action-local.yml).

The action fails closed where bawbel-gate lint does not. On the published bawbel-gate==0.1.0 I ran:

empty directory                     lint manifests/        exit=0, no output
bad schema in a *.yml file          lint m                 exit=0, no output
lint manifests --schema bogus/v9    on a valid tree        exit=0, value ignored

So a mistyped path or a manifest saved as .yml reads as a pass. The action refuses a missing directory, a directory with no *.yaml, and any *.yml file. These are gate behaviours; this PR works around them in this repo only and does not touch gate.

Action inputs and outputs

The root action.yml is unchanged. New action gate-lint inputs: manifests, schema, prod-manifests, forbid-effect, tools-with, version. No outputs.
Inputs renamed or removed: none
Outputs added: none

Verify (run this session, bawbel-gate 0.1.0 from PyPI in a throwaway venv)

I ran the exact run: text of the action's lint step, and the exact script of the GitLab job, against the fixtures. Both give the same result:

ok fixture, prod rule on                     exit=0
egress fixture, prod rule off (control)      exit=0
egress fixture, prod rule on                 exit=1  FAIL publisher.cap.yaml: grant 'publish_post' has forbidden effect 'allow'
bad schema                                   exit=1  FAIL reader.cap.yaml: 1 schema error(s)
empty directory                              exit=1  no *.yaml manifests ... nothing to lint
*.yml next to a valid *.yaml                 exit=1  bawbel-gate lint reads only *.yaml ... Rename them
missing directory                            exit=1
missing prod directory                       exit=1 (action) / exit=2 (lint itself)

Mutation check on a copy of the action: removing the empty-directory guard, the *.yml guard, the prod lint call, the --forbid-effect flag, or the schema lint each turns its fixture into a pass. The missing-directory guards are redundant with find and click, which also fail, only with a different message.

Checks

• Action smoke test passes on this PR (12 of 12 checks, see CI results below)
• Docs and examples/ use the bawbel/integrations/gate-lint@v1 reference
• README and examples/ match the action inputs
• No em dashes

Differences from the runbook

• The runbook says the second command "proves prod manifests cannot silently egress". It reads the manifest only: it fails a prod manifest that sets trifecta.external_comms and has an allow grant. A manifest that leaves the flag unset passes. The README states that and does not claim the stronger thing.
• The action and the GitLab job duplicate the same guard function. The GitLab file is a copy-paste example like the others in examples/, so it is self-contained.

CI results on this PR

gh pr checks 59: 12 pass, 0 fail. That includes passes (valid tree, and the egress fixture with the egress rule off), the six fails closed cases for the new action, and the existing findings, smoke and three scanner fails closed jobs. The passes job running green on the runner is what shows the failing cases fail for the intended reason and not because the install broke.

Not verified

• bawbel/integrations/gate-lint@v1 resolves only after the maintainers move the v1 tag to a commit that contains gate-lint/. Until then, reference a commit SHA. Moving the tag is a release step and is not done here.
• GitLab was not run on GitLab; its script was run locally in bash.