feat: verify: block on commands, with optional onFail remediation (closes #38)

[8bitAlex]

Summary

Closes #38.

Profiles and per-repo raid.yaml files now accept a top-level verify: list. Each entry runs tasks: to assert a precondition (a tool installed, a port reachable, a credentials file present), and an optional onFail: remediation gets exactly one chance to fix things — if it succeeds, raid re-runs tasks: once and the verify is reported as remediated; otherwise it surfaces as a structured VERIFY_FAILED error (category config, exit 2).

• New Verify type and RunVerify(v) error helper in src/internal/lib/verify.go; re-exported via src/raid/raid.go.
• Verify []Verify field on Profile and Repo (the latter merged from per-repo raid.yaml like other fields).
• Schema: new verifyArray $def in raid-defs.schema.json, wired into both raid-profile.schema.json and raid-repo.schema.json via $ref. Entries require name + tasks and accept the full shared task surface (incl. options.continueOnFailure) — same $ref used by install.tasks, environments, and commands.
• New CodeVerifyFailed (VERIFY_FAILED) under CategoryConfig with a VerifyFailed(name, cause) constructor; re-exported through src/raid/errs.
• Profile + repo templates gain a short commented # verify: example so authors see the shape after raid profile create.

Out of scope (deferred to #42): no raid verify CLI command. Verify entries are valid config and RunVerify is ready to call, but the doctor wiring that surfaces them as health-report findings ships with #42.

Verify execution shares context with install: — the active env, raid vars, and task options all apply. No isolation flags, no retry-with-backoff (one re-run after onFail, per the issue).

Test plan

• go test ./... -race — all packages green
• New unit tests in src/internal/lib/verify_test.go cover: passes, fails-without-onFail (asserts VERIFY_FAILED code + details.verify), remediation-succeeds (asserts retry pass ran via marker), remediation-fails (asserts retry did NOT run), second-pass-fails, empty-tasks no-op, IsZero
• Schema validation tests in profile_test.go / repo_test.go exercise accept/reject paths (missing name, missing tasks, unknown field)
• RunVerify and VerifyFailed at 100% line coverage; project coverage 95.0%
• TestPublishedSchemas_matchEmbedded green (site/static/schema/v1/ regenerated via docusaurus plugin on build — gitignored, not committed)
• cd site && npm run build — no broken links
• Schema reference (/docs/references/schema#verify) and whats-new.mdx 0.14.0 — upcoming entry added

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 92.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.33%. Comparing base (f48146f) to head (d22dddc).

Files with missing lines	Patch %	Lines
src/raid/raid.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #86      +/-   ##
==========================================
- Coverage   92.33%   92.33%   -0.01%     
==========================================
  Files          36       37       +1     
  Lines        3355     3380      +25     
==========================================
+ Hits         3098     3121      +23     
- Misses        166      168       +2     
  Partials       91       91              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Adds declarative verify: configuration support for profiles and per-repo configs, including execution logic, schema support, public re-exports, structured errors, tests, templates, and documentation.

Changes:

• Introduces Verify and RunVerify with optional one-shot onFail remediation.
• Adds verify fields to profile/repo models and schemas, including merge behavior for per-repo raid.yaml.
• Documents verify blocks and adds tests for execution, validation, and public error exports.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/internal/lib/verify.go	Adds verify model and runner logic.
src/internal/lib/verify_test.go	Tests verify pass/fail/remediation behavior.
src/internal/lib/repo.go	Adds repo-level verify config and merge support.
src/internal/lib/repo_test.go	Tests repo schema validation for verify blocks.
src/internal/lib/profile.go	Adds profile-level verify config.
src/internal/lib/profile_test.go	Tests profile schema validation for verify blocks.
src/internal/lib/errs/raid_error.go	Adds VERIFY_FAILED error code.
src/internal/lib/errs/constructors.go	Adds VerifyFailed structured error constructor.
src/internal/lib/errs/raid_error_test.go	Covers verify error constructor.
src/raid/raid.go	Re-exports verify type and runner.
src/raid/errs/errs.go	Re-exports verify error code and constructor.
src/raid/errs/errs_test.go	Tests public verify error export.
schemas/raid-defs.schema.json	Defines shared verify schema.
schemas/raid-profile.schema.json	Wires verify into profile schema.
schemas/raid-repo.schema.json	Wires verify into repo schema.
src/resources/profile-template	Adds commented verify example.
src/resources/repo-template	Adds commented verify example.
site/docs/references/schema.mdx	Adds schema reference docs for verify.
site/docs/whats-new.mdx	Adds upcoming release note for verify support.

[8bitAlex]

Auto-review by meeseeks

Updates pushed: 1 commit

• d22dddc fix: address Copilot review — yaml tags + accurate doctor wording

Copilot comments addressed: 5 of 5

• src/internal/lib/verify.go — added yaml:"onFail,omitempty" (and matching tags on name/tasks for explicitness); added TestVerify_yamlRoundTrip covering camelCase YAML extraction
• src/resources/repo-template — reworded so generated configs don't claim raid doctor already runs verify (deferred to Polished doctor output — formatting, fix hints, summary #42)
• src/resources/profile-template — same reword
• site/docs/references/schema.mdx — aligned wording with implemented behavior (schema accepts entries today; doctor wiring is future)
• src/internal/lib/errs/raid_error.go (errors.mdx update) — added VERIFY_FAILED row to site/docs/references/errors.mdx under the config category

Skipped: 0

Codecov patch: 92.00% (project 92.33%) — within 8pt rule (-0.33pp), pass. The 2 uncovered lines flagged are in src/raid/raid.go (public re-exports — typically thin wrappers exercised indirectly); not worth a synthetic test for the re-export shape.

Other CI: green (build/macos/ubuntu/windows, docs, version-check, CodeQL all pass)