Promote trigger to a subcommand + add trust-root-touched verify check (M1)

[pengfei-threemoonslab]

Summary

• Promote the existing trigger evaluator to a first-class agents-shipgate trigger subcommand. It takes --changed-files/--diff file inputs and --base/--head git mode (the only path that shells out to git), keeps --list-rules --json, and preserves python -m agents_shipgate.triggers for developers. evaluate() now emits the M1 output shape (should_run, force_run, skip_reason, changed_files, diff_tokens) alongside the preserved back-compat fields (run_shipgate, stop_conditions_fired, rationale); action precedence is unchanged.
• Add SHIP-VERIFY-TRUST-ROOT-TOUCHED — the cheap half of the reward-hacking guard. A changed-files-only path classifier in a new verify check category that fires only when a VerificationContext is present (scan --changed-files) and emits an ordinary medium-severity Finding routed through release_decision to review_required — never a second verdict. Plain scan behavior is unchanged.
• Add a reverse docs/triggers.json ↔ AGENTS.md parity test. Closing the gap it surfaced required a new TRIGGER-N8N-WORKFLOW-CHANGED rule (keyed on the adapter's own n8n-nodes-* markers), so the prose table and catalog are now in true parity.

Why

This is milestone M1 of the AI coding workflow verifier direction (roadmap P0): productize the trigger evaluator and land trust-root protection. Reward hacking is the coding-agent threat model — an optimizer told to "make CI green" may edit the gate instead of fixing the readiness issue — so touching a release trust root (manifest, policies, prompts, the Shipgate CI gate, agent instructions, tool-surface declarations) now requires human review. The verify command's base/head orchestration is the separate P1 milestone; scan --changed-files is the M1 injection point that makes the check reachable through the existing gate.

Type

• Check or risk-model change
• CLI or GitHub Action behavior

Verification

CI is authoritative for python -m ruff check ., python -m compileall -q src tests, and python -m pytest.

Additional local checks run:

• python -m ruff check . — clean.
• python -m pytest — 2104 passed, 5 skipped. The 7 tests/test_bootstrap.py failures are pre-existing and environmental (confirmed identical on main): this sandbox's editable install points at a sibling worktree without __main__.py, so bootstrap's python -m agents_shipgate subprocess can't resolve. They are unrelated to this change.
• python scripts/generate_schemas.py --check — docs/checks.json (and manifest/report/packet schemas) in sync.
• Smoke-tested both trigger modes (file inputs and --base/--head git) and scan --changed-files end-to-end (trust-root finding flows to review_required).

Release-readiness notes

• No user-code import added to default scan paths
• No network access added to default scan paths (git runs only under trigger --base/--head; the trust-boundary allowlist in tests/test_adapter_static_only.py and STABILITY.md § Meta-CLI surfaces are updated to pin the new call sites)
• New or changed check IDs are documented in docs/checks.md (SHIP-VERIFY-TRUST-ROOT-TOUCHED)
• Report/schema changes are additive or documented in STABILITY.md (new verify category in docs/checks.json; new trigger command + scan --changed-files flag added to the stable command surface)

🤖 Generated with Claude Code