feat: add public CI, Homebrew, and benchmark assets

[hudsonaikins]

Summary

• add GitHub Actions PR/main verification so the public repo has stable GitHub-side checks
• add a Homebrew formula plus tap-publish script and wire the public docs to the tap flow
• commit shareable benchmark compare reports and example output snippets for public evaluation
• tighten the design-partner intake loop around benchmark -> install -> compare -> calibrate

Validation

• env GOCACHE=/tmp/profitctl-go-build GOTMPDIR=/tmp/profitctl-go-tmp go test ./...
• bash -n scripts/install.sh
• bash -n scripts/release/publish-homebrew-tap.sh
• Homebrew tap install verified against IntelIP/homebrew-profitctl
• profitctl --help verified after Homebrew install
• committed benchmark reports generated from current CLI output

Greptile Summary

This PR adds public-facing CI (GitHub Actions with verify-go and verify-install-smoke jobs), a Homebrew formula for v0.1.2 with a tap-publish script, committed benchmark comparison reports for open-core and hybrid pricing scenarios, and tidies up the design-partner intake flow. The Go engine, covenant, and margin changes add interface-backed implementations with comprehensive test coverage.

• The publish-homebrew-tap.sh script commits to the tap repo without configuring user.email / user.name, which will fail in any CI environment where git identity is not globally pre-set.

Confidence Score: 4/5

Safe to merge after fixing the missing git identity configuration in the tap-publish script.

One P1 defect: the tap-publish script will hard-fail on any CI runner without a global git identity, blocking automated Homebrew releases. All other changes — CI workflow, Homebrew formula, Go engine/covenant/margin code, and tests — are correct and well-structured.

scripts/release/publish-homebrew-tap.sh

Important Files Changed

Filename	Overview
scripts/release/publish-homebrew-tap.sh	New tap-publish script – commits to the tap repo without configuring git user identity, which will fail in CI environments where global git config is absent.
.github/workflows/ci.yml	Adds verify-go (fmt, vet, tests) and verify-install-smoke (build artifacts, local mirror, installer end-to-end) jobs; both jobs are well-structured and reference existing scripts and example files.
Formula/profitctl.rb	New Homebrew formula for v0.1.2 with per-arch binaries and SHA256 checksums; test block asserts on help text string, which is an expected pattern.
internal/config/parser.go	Config parser adds calibration_file mutual-exclusivity check, normalization helpers, and new struct fields (HybridContract, PilotConfig, SimulationConfig); logic is clean and correct.
internal/cost/engine.go	CostEngine interface and implementation calculating fixed, variable, and total costs with rounding; unused users param in CalculateFixedCosts is intentional (fixed costs are user-independent).
internal/covenant/engine.go	Covenant validation engine supporting threshold operators (gt/lt/gte/lte/eq) and p95/p99 percentile fields; unknown fields/operators are silently skipped, defended by parse-time validation upstream.
internal/pricing/margin.go	Margin calculator with layer breakdowns, cost-per-user, and rounding to 2 decimal places; zero-division guards present for revenue and users.
internal/cost/engine_test.go	Comprehensive tests for CostEngine covering empty config, zero users, all layers, and layer aggregation; no issues found.
internal/pricing/margin_test.go	Full test coverage of CalculateMargins including zero revenue, zero costs, negative margin, precision rounding, and layer percentages; all assertions look correct.
internal/scanner/collector_test.go	Tests for file collection, size limits, non-existent directories, and file reading; adds a benchmark for the Collect operation.

Sequence Diagram

sequenceDiagram
    participant Dev as Developer / CI
    participant GH as GitHub Actions
    participant Mirror as Local Mirror (RUNNER_TEMP)
    participant Tap as IntelIP/homebrew-profitctl

    Dev->>GH: push / PR to main
    GH->>GH: verify-go (fmt, vet, test)
    GH->>GH: build-artifacts.sh (v0.0.0-ci)
    GH->>Mirror: create mirror layout + index.json
    GH->>GH: install.sh (PROFITCTL_TEST_MIRROR)
    GH->>GH: profitctl --help + validate smoke

    Dev->>Dev: run publish-homebrew-tap.sh
    Dev->>Tap: gh repo clone (depth=1)
    Dev->>Tap: cp Formula/profitctl.rb
    Dev->>Tap: git commit + push
    Tap-->>Dev: tap updated

Loading

Prompt To Fix All With AI

This is a comment left during a code review.
Path: scripts/release/publish-homebrew-tap.sh
Line: 27-29

Comment:
**Missing git user identity before commit**

`git commit` requires `user.email` and `user.name` to be configured. In a fresh CI environment (e.g., GitHub Actions runner), these are not set by default, so line 28 will fail with `"Please tell me who you are."` The script's `set -euo pipefail` will surface this as a hard exit without a clear error message.

```suggestion
git -C "${TMP_DIR}/tap" config user.email "github-actions[bot]@users.noreply.github.com"
git -C "${TMP_DIR}/tap" config user.name "github-actions[bot]"
git -C "${TMP_DIR}/tap" add Formula/profitctl.rb
git -C "${TMP_DIR}/tap" commit -m "chore: update profitctl formula"
git -C "${TMP_DIR}/tap" push origin HEAD
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "style: normalize gofmt output for CI" | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[greptile-apps]

Missing git user identity before commit

git commit requires user.email and user.name to be configured. In a fresh CI environment (e.g., GitHub Actions runner), these are not set by default, so line 28 will fail with "Please tell me who you are." The script's set -euo pipefail will surface this as a hard exit without a clear error message.

Suggested change

	git -C "${TMP_DIR}/tap" add Formula/profitctl.rb
	git -C "${TMP_DIR}/tap" commit -m "chore: update profitctl formula"
	git -C "${TMP_DIR}/tap" push origin HEAD
	git -C "${TMP_DIR}/tap" config user.email "github-actions[bot]@users.noreply.github.com"
	git -C "${TMP_DIR}/tap" config user.name "github-actions[bot]"
	git -C "${TMP_DIR}/tap" add Formula/profitctl.rb
	git -C "${TMP_DIR}/tap" commit -m "chore: update profitctl formula"
	git -C "${TMP_DIR}/tap" push origin HEAD

Prompt To Fix With AI

This is a comment left during a code review.
Path: scripts/release/publish-homebrew-tap.sh
Line: 27-29

Comment:
**Missing git user identity before commit**

`git commit` requires `user.email` and `user.name` to be configured. In a fresh CI environment (e.g., GitHub Actions runner), these are not set by default, so line 28 will fail with `"Please tell me who you are."` The script's `set -euo pipefail` will surface this as a hard exit without a clear error message.

```suggestion
git -C "${TMP_DIR}/tap" config user.email "github-actions[bot]@users.noreply.github.com"
git -C "${TMP_DIR}/tap" config user.name "github-actions[bot]"
git -C "${TMP_DIR}/tap" add Formula/profitctl.rb
git -C "${TMP_DIR}/tap" commit -m "chore: update profitctl formula"
git -C "${TMP_DIR}/tap" push origin HEAD
```

How can I resolve this? If you propose a fix, please make it concise.