CI: build/test gate, artifact-split enforcement, plan and licence invariants

[tom-snyder]

Summary

PR #1 merged with statusCheckRollup: [] — zero check protection. I flagged that at merge time; this closes it before Phases 1–7 start landing code.

Why this shape

Anvil's plan makes three claims that are only true if something enforces them continuously:

1. The two-artifact split is real, not conventional. 00-SPINE.md §S9-AMENDED splits anvil from anvil-dast, and §2.2 rules that a boolean inside a shipped binary still supplies the capability to everyone. An unenforced convention is the same as a boolean — it holds right up until someone adds an import.
2. plan_xref.py gets re-run after every area-file edit. IMPLEMENTATION-PLAN.md §2.6 says so. Documentation does not cause that to happen; a required check does.
3. Licences are read as file bodies, never metadata (§S8), and the §S5 exclusions are enforced, not advisory.

Jobs

Job	What it does
go	gofmt, vet, build, go test -race, plus go mod tidy must be a no-op so a dropped or drifted pin fails loudly
artifact-split	Runs TestSplit, then injects an internal/dast import and fails the build if the guard passes. Builds all four linux/{amd64,arm64} × {anvil,anvil-dast} static binaries. Fails if mattn/go-sqlite3 ever enters the graph.
plan	tools/plan_xref.py — 158 packets, 7 invariants
licence	LICENSE sha256 == canonical Apache-2.0; C.1's three files non-empty; no §S5 exclusion in go.mod/go.sum

The negative control in artifact-split is the part I'd most want reviewed. A guard that has never failed has not been tested, and this one now has to prove it can fail on every run.

Two fixes the gate found by being run locally first

internal/buildpin — go mod tidy removes modules nothing imports. Nothing imports modernc.org/sqlite yet (the store is R.4, its FTS5 guard is R.5), so the tidy check would have silently deleted the pin Phase 0 exists to establish. This package holds it and names its own deletion condition in a comment.

.gitattributes — the Windows working tree had CRLF, so gofmt -l flagged every Go file locally while CI (seeing LF) would have passed. Local verification that disagrees with CI is worse than none, and every packet owes build evidence. Now * text=auto eol=lf. Git had stored LICENSE correctly as LF the whole time — verified by hashing the blob directly (git cat-file -p HEAD:LICENSE | sha256sum → cfc7749b…), so only the checkout was affected and nothing on main was wrong.

Risk

Low. No production code paths. The realistic failure mode is a CI job being wrong about its own environment, which the first run on this PR will surface.

Testing

Every job was run locally first, except one:

gofmt -l .                     clean
go vet ./...                   clean
go build ./...                 clean
go mod tidy                    no-op (verified by diff)
CGO_ENABLED=0 GOOS=linux       4 binaries, amd64 + arm64
TestSplit negative control     FAILS on injected import, PASSES after revert
sha256sum LICENSE              cfc7749b…23d30
python tools/plan_xref.py      clean

Known gap, stated rather than hidden: go test -race cannot run on this Windows host — the race detector needs a C toolchain and cgo.exe exits 2. That one line of evidence comes from CI only.

Follow-up

Once this is green, main should get branch protection requiring these four checks. That needs admin rights on the repo and is a settings change, so I have not done it — say the word and I will, or you can flip it in Settings → Branches.