test(cli): add subprocess-based unit tests for v0.17.0 task scripts (#293)

[MScottAdams]

Summary

Add subprocess-based unit tests for all v0.17.0 deterministic task scripts.

Closes #293

Changes

• New file: ests/cli/test_task_scripts.py with 25 subprocess-based test cases
• SPECIFICATION.md: Filled t3.3.4 acceptance criteria placeholder
• CHANGELOG.md: Added entry under [Unreleased]

Checklist

• SPECIFICATION.md has task coverage (t3.3.4)
• CHANGELOG.md entry under [Unreleased]
• task check passes
• Coverage >= 85%% (87.58%%)
• /deft:change proposal: N/A (test-only, less than 3 file changes)

[greptile-apps]

Greptile Summary

This PR adds tests/cli/test_task_scripts.py — 25 subprocess-based unit tests covering the four v0.17.0 task scripts and two go-task CLI commands — and fills in the t3.3.4 acceptance criteria in SPECIFICATION.md. The LINK_CHECK_STRICT env-isolation issue flagged in the prior review round is correctly addressed by explicitly setting the variable to "" in test_broken_internal_link_warning_mode. The only remaining note is that _setup_repo does not disable commit.gpgsign, which can cause TestCommitLint tests to error in environments with global GPG signing enabled.

Confidence Score: 5/5

Safe to merge — the only finding is a P2 reliability note about GPG signing in test fixtures, which does not affect CI (task CLI is skipped there) or production code.

All findings are P2 or lower. The LINK_CHECK_STRICT isolation concern from prior rounds is correctly resolved. The GPG signing gap in _setup_repo is a local-dev reliability edge case, not a correctness or security issue, and the affected tests are already skip-guarded in CI via @requires_task.

tests/cli/test_task_scripts.py — _setup_repo helper (lines 344–360) should add commit.gpgsign=false for GPG-signing environments

Important Files Changed

Filename	Overview
tests/cli/test_task_scripts.py	New file: 25 subprocess-based tests across 5 classes covering toolchain-check.py, verify-stubs.py, validate-links.py, change:init, and commit:lint; LINK_CHECK_STRICT isolation addressed; _setup_repo helper lacks commit.gpgsign=false guard
SPECIFICATION.md	Added t3.3.4 acceptance criteria with full bullet-point list matching the 25 test cases; status set to [completed]
CHANGELOG.md	Added [Unreleased] entry for t3.3.4 with accurate test case summary; coverage figure 87.58% is stated correctly

Prompt To Fix All With AI

This is a comment left during a code review.
Path: tests/cli/test_task_scripts.py
Line: 344-360

Comment:
**GPG signing not disabled in test commits**

`_setup_repo` configures `user.email` and `user.name` locally but does not disable `commit.gpgsign`. If a developer's global `~/.gitconfig` has `commit.gpgsign=true`, the `git commit` call (with `check=True`) will raise `CalledProcessError` rather than yielding a clean fixture commit. All four `TestCommitLint` tests would error rather than run.

Since these are ephemeral test-fixture commits, passing `-c commit.gpgsign=false` is the standard guard:

```suggestion
    def _setup_repo(self, tmp_path: Path, message: str) -> None:
        """Create a git repo with one commit using the given message."""
        subprocess.run(["git", "init"], cwd=str(tmp_path), capture_output=True, check=True)
        subprocess.run(
            ["git", "config", "user.email", "test@test.com"],
            cwd=str(tmp_path), capture_output=True, check=True,
        )
        subprocess.run(
            ["git", "config", "user.name", "Test"],
            cwd=str(tmp_path), capture_output=True, check=True,
        )
        subprocess.run(
            ["git", "config", "commit.gpgsign", "false"],
            cwd=str(tmp_path), capture_output=True, check=True,
        )
        (tmp_path / "f.txt").write_text("x", encoding="utf-8")
        subprocess.run(["git", "add", "."], cwd=str(tmp_path), capture_output=True, check=True)
        subprocess.run(
            ["git", "commit", "-m", message],
            cwd=str(tmp_path), capture_output=True, check=True,
        )
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (4): Last reviewed commit: "fix(test): address Greptile round-2 find..." | Re-trigger Greptile}

[MScottAdams]

Rebase-only force-push onto updated master (absorbed #298 CHANGELOG/SPECIFICATION changes). No logic changes -- pure rebase.