feat(ci): add repo-hygiene gates -- gitignore drift, skill-rename lifecycle, duplicate-script sync

[tvna]

Derived from triage of the retrospective-issue backlog (label:retrospective). Classified as: feature.

Facts: retrospective issues #242, #285, #330, and #347 each found a repo-hygiene drift gap: a new .gitignore entry with no test verifying the pattern works (#330), a renamed skill directory's sidecar omitting spec.lifecycle.renamedFrom with nothing catching it (#285), two duplicated check_acm_present.py copies with no sync check between them (#242), and the sole remaining .gitignore drift test using "git check-ignore -q" which cannot tell which exclude source matched (#347).

Requested outcome: four small, independent CI/pytest checks close these gaps so a future edit cannot silently regress .gitignore coverage, skill-rename metadata, or cross-copy consistency.

Note: the Acceptance Criteria Map below is a draft for the eventual implementer to independently re-check against the cited retrospective issues, not a pre-verified result.

Acceptance Criteria Map

Criterion	Interpretation	Planned ops	Proof method	Residual risk
A newly-added .gitignore pattern must have a test asserting it via "git check-ignore" (#330)	Diff .gitignore against the PR's merge-base (three-dot diff) and fail if a new pattern has no matching test	New CI/pytest check, mirroring gate_skill_rename_lifecycle.py's pattern	Add a new .gitignore pattern with no test and confirm the check fails; add the test and confirm it passes	Detecting "a test asserts this pattern" mechanically requires the test to reference the literal pattern string, which could miss an indirectly-parameterized test
The .gitignore drift test must assert the match resolves to this repo's own .gitignore, not just exit 0 (#347)	Switch from "git check-ignore -q" to "-v" and assert the reported source file is the repo's own .gitignore	Modify the existing drift test	Simulate an ambient exclude rule masking a deleted repo rule and confirm the test now catches it	None identified
A renamed skill directory's surviving sidecar must set spec.lifecycle.renamedFrom to the old directory name (#285)	Detect a renamed skill directory in the PR diff and fail if renamedFrom is absent or names the wrong directory	New check in check_skill_shape.py or a sibling CI script	Rename a skill directory without setting renamedFrom and confirm the check fails; set it correctly and confirm it passes	Rename detection itself needs a reliable mechanism (git diff similarity heuristics have known blind spots per #293's own finding)
Two check_acm_present.py-shaped duplicate scripts must have identical core header-regexes, or an explicit divergence marker (#242)	A repo-wide test finds every duplicate script under skills/*/scripts/ and asserts their header-regex matches, unless both copies carry an "intentionally diverged" marker comment	New test, alongside tests/test_skill_metadata_sidecar.py's existing cross-skill invariants	Diverge one copy without the marker and confirm the test fails; add the marker to both and confirm it passes	Detecting "check_acm_present.py-shaped" duplicates by pattern-matching filenames/content could miss a differently-named future duplicate

Constraints: none stated.

Non-goals: does not cover parser-hardening or citation-resolution checks proposed separately (different mechanisms, tracked in sibling issues).

Next Move: draft ready; implementation is separate follow-on work.

[github-actions]

This issue's body does not disclose an Acceptance Criteria Map (ACM) or an explicit waiver. Per skills/drafting-an-acm-issue/SKILL.md (see issue #357), add either:

• an ACM table (criterion -> interpretation -> planned ops -> proof method -> residual risk), or
• a waiver line: ACM: not-applicable (chore|docs|tracking): <reason>

This is a post-hoc, non-blocking flag (issue #414) -- it does not prevent this issue from being worked on, and applies regardless of who or what opened it.