Add opt-in source-bound ruleset profiles

[mochan-tk]

Closes #99

Plan: #99 (comment)

Summary

Adds opt-in --profile solo|team handling to the explicit ruleset actuator while leaving the no-profile path unchanged. Explicit intent is persisted before fresh ruleset creation; team payloads bind every required context to one common App ID derived from paginated latest check runs on the target repository's default branch. All invalid, incomplete, mixed, unauthorized, unavailable, or failed evidence/persistence paths stop before a ruleset write.

Tests-first record

• Original tests-only commit/head: a494b9ead97b94a34948944a738450ff3832ade2
• Preserved completed expected-red run: https://github.com/mochan-tk/agentic-dev-kit-for-copilot/actions/runs/31997677917 (completed / failure on the exact tests-only head)
• Expected-red separation: all 14 pre-existing legacy assertions were ok; all 24 new profile-contract assertions were not ok; the cumulative no-DELETE/no-probe wall was ok; summary 39 case(s), 24 failed.
• Fixture-contract correction: 0951ae6 (test-only), followed by production-only commit e6e7ad6.
• First official Rubber Duck gate: PASS after resolving precise failure injection, successful PATCH coverage, default-branch binding, discriminating same-name refusal, per-case failure reasons, and PUT mutation detection.
• Second official Rubber Duck gate: PASS after the complete deterministic wall; no substantive findings.

Evidence

Criterion	Evidence (command / link)	Result
Fixed fixtures committed first with expected-red evidence	Commit a494b9e; preserved run 31997677917 on exact head; production appears only in later e6e7ad6	pass
--profile solo|team; invalid usage; unchanged no-profile path	bash .github/scripts/tests/run-tests.sh setup-ruleset -> 39 case(s), 0 failed; production diff is additive and all legacy assertions pass	pass
Bare, solo, and team dry-run boundaries	Focused fixtures prove zero calls for bare/solo and GET-only metadata/check-run discovery for team	pass
Explicit-profile same-name refusal before writes	Recording fixture requires rulesets GET, reconciliation-required failure, and zero variable/ruleset writes	pass
Paginated default-branch discovery and fail-closed issuer evidence	Fixtures cover nontrivial trunk, latest/pagination, missing/multiple/cross-context/numeric+null/numeric+malformed evidence	pass
Source-bound team controls with no hard-coded App ID	Live GET-only payload assertion passes for four contexts/one common ID/all five controls; production contains no 15368	pass
Explicit solo equals current solo payload; omission persists nothing	Focused fixtures prove solo payload parity and zero-call solo dry-run; all legacy cases remain green	pass
All reads before writes; exact variable persistence before ruleset POST	Recording shim asserts all reads, exact create/update value, variable-before-ruleset ordering	pass
Variable endpoint/read/create/update failures and distinct ruleset failure	Focused wall covers unreadable/Actions-disabled/create/update and post-persistence ruleset-create failure	pass
Mutation ordering and prohibition wall	Fixtures require zero writes after discovery/read failure, exactly one failed variable write with no later ruleset mutation, and no DELETE/probe/dry-run write	pass
Bash 3.2, existing dependencies, <=400 changed lines	Complete issue Verification chain exited 0; full wall reports all 23 guard files passed; shellcheck and all scaffold checks pass; owned-path numstat is 380	pass

Fresh custom reviewer audit

Disposition: GAPS. The fresh risk:high reviewer independently verified Task linkage, authorization chronology, tests-first expected-red history, the surgical correction, production separation, every acceptance criterion, live GET-only behavior, no test/check weakening, exact ownership, the 380-line budget, governance safety, deviation honesty, and final CI run https://github.com/mochan-tk/agentic-dev-kit-for-copilot/actions/runs/31998430977 at exact head e6e7ad68abcaa40b5b68993426fca74148b61735 with all five jobs successful.

The sole gap is review-gate provenance: this app surface exposes the completed Rubber Duck child agents (tests-first-duck, tests-first-duck-final, and implementation-duck, owned by worker session fe292f8a-6ed5-4b6b-8fce-1ae21d500ee5) but supplied no independently inspectable GitHub run/session URL or immutable timestamp artifact. The reviewer therefore treats both PASS statements above as attestation-only and requires durable historical references proving the first gate preceded the fixture-only commit and the second followed deterministic verification. A new run cannot substitute for missing historical chronology.

The requester explicitly accepted this disclosed provenance limitation as a Task #99 exception: #99 (comment). This human decision accepts the app-local PASS attestations without rewriting the fresh reviewer GAPS disposition, inventing chronology, or treating a later review as historical proof. All other gates remain unchanged.

Deviations

During the initial local production implementation, the focused wall exposed an impossible blanket test condition: the Plan phrase persistence failure ... before writes could be read to forbid the intentionally attempted variable write itself, while the issue acceptance criterion and the Plan's variable-before-ruleset sequence require that POST/PATCH attempt to fail and then prohibit any ruleset write. The supervisor and Epic parent clarified the existing contract without changing the Plan. Commit 0951ae6 surgically requires exactly one failed variable create/update attempt and zero later ruleset/probe mutation; discovery/read failures retain the original zero-write helper. This correction was committed separately before the production commit, but it did not predate the initial local production edit. The original tests-only commit and expected-red run remain preserved.

No implementation deviation from the clarified Task contract remains.

Follow-ups

No implementation follow-up. Readiness awaits supervisor independent final-ledger verification and Epic-parent report. Serialized followers #96 and #97 remain blocked and untouched.

Checklist

• Plan was posted as a Task-issue comment before implementation and is linked above.
• Diff stays inside the issue's File ownership paths.
• Every command in the issue's Verification section was run; output captured above.
• No test, lint rule, or CI check was deleted, skipped, or weakened.
• Record-before-report comment posted on the Task issue (supervisor-owned ritual).
• All persistent artifacts in this PR are English-only.

[mochan-tk]

Human approval: PR #100 is approved after strict-restart authorization, durable tests-only expected-red run, fail-closed mixed issuer coverage, exact two-path ownership, 380-line bound, and current-head CI 5/5. The repository owner explicitly accepts the disclosed app-local Rubber Duck provenance limitation for Task #99 and authorizes administrator merge.