Forge-cli v1 Sprint 7: parity harness, exit-code matrix, fixture lint

[graysurf]

Summary

Sprint 7 of the forge-cli v1 plan locks the contract behind tests: a cross-provider parity harness, the full exit-code matrix, and a fixture redaction lint wired into the docs-only entrypoint. After this PR merges, only Sprint 8 (wrapper + Homebrew tap + nils-cli minor bump) remains.

Changes

• crates/forge-cli/tests/integration/parity.rs (new) — driver iterates an 11-row parity matrix and asserts four cross-provider envelope invariants per row: schema literal matches, ok=true on both, data.provider differs only at the documented field, and warnings stays empty/omitted. Covers repo view, pr checks, pr wait-checks, pr merge, every issue atom, and pr deliver. Plus one negative-control test that pins the harness's own schema-mismatch detection.
• crates/forge-cli/tests/integration/exit_codes_full.rs (new) — 12 tests covering every row in spec §"Exit code map" plus every error.kind row in spec §"Lock-down policy". Each test references the constant name from nils_common::cli_contract::exit, never the numeric value, so a sysexits re-number is caught instead of drifting silently. A binary_only_emits_documented_exit_constants invariant pins the six-constant set.
• scripts/ci/forge-cli-fixture-lint.sh (new) — grep-based lint refusing any of gh{ps,r,o}_<base62>, glpat-<base62>, or Bearer <opaque> matches under crates/forge-cli/tests/fixtures/. Wired into .agents/skills/nils-cli-verify-required-checks/scripts/nils-cli-verify-required-checks.sh so the docs-only lane catches un-redacted fixtures before merge.
• crates/forge-cli/tests/integration/fixture_lint.rs (new) — planted-token regression test that writes a synthetic ghp_<20-byte> string into a tempdir, runs the lint against that root, and asserts non-zero exit + filename + offending match in stderr. Companion fixture_lint_passes_on_clean_tempdir test pins the success path.
• crates/forge-cli/tests/fixtures/README.md (new) — documents the redaction policy and pattern table, plus the negative regression test's behaviour.
• Execution ledger — docs/plans/forge-cli/forge-cli-execution-state.md records Tasks 7.1 + 7.2 + 7.3 with branch-level evidence.

Test-First Evidence

• Change classification: new test infrastructure (no production code edits in Sprint 7).
• Failing test before fix: not applicable.
• Final validation:
  • cargo test -p nils-forge-cli — 219 lib + 89 integration green (was 219 + 70 at end of Sprint 6).
  • cargo clippy -p nils-forge-cli --all-targets -- -D warnings — clean.
  • bash scripts/ci/forge-cli-fixture-lint.sh --strict — pass (18 files scanned, 0 matches).
  • bash scripts/ci/cli-output-contract-lint.sh — pass.
• Waiver reason: n/a.

Testing

• pass: cargo test -p nils-forge-cli (308 total).
• pass: cargo clippy -p nils-forge-cli --all-targets -- -D warnings.
• pass: bash scripts/ci/forge-cli-fixture-lint.sh --strict.
• pass: workspace CI gates (cli-output-contract, completion, third-party-artifacts).

Risk / Notes

• The parity harness ships against the dry-run path of every atom (which is provider-symmetric by construction). Full-shape byte-equality for the mutating ops is still exercised by the per-op suites with paired fixtures; the harness pins the structural invariants Sprint 8 will rely on when shipping the brew tap formula.
• The fixture lint runs under the docs-only entrypoint AND in the integration test, so a regression caught in either lane fails the PR before it reaches the macOS / Linux test workflows.
• Sprint 8 (wrapper + completion installation + Homebrew tap formula + nils-cli minor bump) is the final v1 milestone and is now unblocked.

[github-actions]

Coverage

Total line coverage: 85.42% (75409/88276 lines hit).