v3.13.0: Action-provisioned type-aware sidecar, flag-proof agent gate

The GitHub Action now provisions the type-aware sidecar itself, and the agent gate stops being fooled by git-level flags.

Features

The Action wires type-aware analysis end to end. A new tri-state type-aware input defaults to auto, which reads your project config: when typeAware.enabled is on (and audit.typeAware does not override it), the Action installs fallow-type-aware at exactly the CLI version it resolved, verifies the version match fail-closed, and exports FALLOW_TYPE_AWARE_BIN. Set true to force provisioning or false to skip it and run fully syntactic. Until now the Action installed only the standalone binary, so typeAware-enabled projects needed manual sidecar wiring in CI.

Bug fixes

The agent gate recognizes git -c … commit and friends. The gate installed by fallow hooks install --target agent only audited git commit / git push when the subcommand immediately followed git, so ordinary forms like git -c user.name=x commit, git --no-pager commit, or git -C dir push silently skipped the audit. Command recognition now tokenizes and steps over git-level options (including value-taking ones like -c, -C, --git-dir) while still ignoring lookalikes such as git log commit-message.txt or git stash push. A new FALLOW_GATE_DEBUG environment variable surfaces skip decisions on stderr for troubleshooting. Thanks @wouterkroes for the meticulously reproduced report, the payload-based test approach went straight into the test suite.

Full Changelog: v3.12.0...v3.13.0