feat: Phase 0 — install and initialize gh-aw in .github-private

.github/agents/agentic-workflows.agent.md

@@ -0,0 +1,36 @@
+---
+name: agentic-workflows
+description: >
+  Dispatcher for gh-aw agentic workflows in petry-projects/.github-private.
+  Routes GitHub events to the appropriate workflow definition and executes
+  them using Claude as the engine.
+engine: claude
+tools: ["read", "search", "execute"]
+---
+
+You are the agentic workflow dispatcher for `petry-projects/.github-private`.
+
+## Engine
+
+This dispatcher uses Claude via `CLAUDE_CODE_OAUTH_TOKEN` as the execution engine.
+
+## Workflows
+
+Dispatch to the appropriate workflow based on the GitHub event context:
+
+- `issue-triage` — triages newly opened issues, applies labels, and routes to the right team
+- `ci-failure-analyst` — analyzes CI failures on PRs and posts a root-cause summary
+
+## Dispatch rules
+
+1. Read the incoming event payload from context
+2. Match against available workflow definitions in `.github/workflows/*.md`
+3. Execute the matched workflow with the event payload
+4. Post results back to the triggering issue, PR, or workflow run
+
+## Constraints
+
+- Never modify `.github/workflows/agent-shield.yml`
+- Follow org standards in `AGENTS.md` and `petry-projects/.github/AGENTS.md`
+- Use `GITHUB_TOKEN` for GitHub API calls; use `CLAUDE_CODE_OAUTH_TOKEN` for Claude invocations
+- Do not store or log secrets

.github/workflows/lint.yml

@@ -34,3 +34,20 @@
 
       - name: Run tests
         run: bats tests/fleet_report.bats
+
+  gh-aw-compile:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+
+      - name: Install gh-aw
+        run: curl -sL https://raw.githubusercontent.com/github/gh-aw/main/install-gh-aw.sh | bash
+
+      - name: Compile agentic workflows
+        run: |
+          if ls .github/workflows/*.md > /dev/null 2>&1; then
+            gh aw compile
+          else
+            echo "No .github/workflows/*.md files found — skipping compile."
+          fi

tests/aw/README.md

@@ -0,0 +1,70 @@
+# Agentic Workflow Tests
+
+This directory contains scenario specs and smoke tests for `gh-aw` agentic workflows.
+
+## Test methodology
+
+Tests follow a three-level approach:
+
+1. **Compile validation (CI gate)** — `gh aw compile` runs on every PR that touches `.github/workflows/*.md`. A compile failure blocks merge. No runtime required.
+
+2. **Staged smoke tests (pre-merge)** — Run a workflow against a fixture payload without posting real GitHub API side-effects. Use `--staged` to dry-run:
+   ```
+   gh aw run <workflow-name> --staged --payload tests/aw/<workflow-name>/fixtures/<fixture>.json
+   ```
+   Smoke tests assert that the workflow reaches the expected terminal state and produces the expected output structure.
+
+3. **Integration tests (manual / scheduled)** — Execute against a real GitHub event in a sandbox repo. Reserved for release-gate validation; not required on every PR.
+
+## Scenario spec format
+
+Write scenario specs **before** the workflow markdown. Each spec lives in `tests/aw/<workflow-name>/` as a plain markdown file:
+
+```
+tests/aw/<workflow-name>/
+  README.md          ← scenario specs (this pattern)
+  fixtures/          ← JSON payloads matching GitHub webhook schemas
+  smoke.sh           ← staged smoke test runner (optional)
+```
+
+A scenario spec block:
+
+```markdown
+### Scenario: <name>
+
+**Given** <precondition>
+**When** <event / trigger>
+**Then** <expected outcome>
+
+**Fixture:** `fixtures/<name>.json`
+```
+
+## Running compile validation locally
+
+```bash
+curl -sL https://raw.githubusercontent.com/github/gh-aw/main/install-gh-aw.sh | bash
+gh aw compile
+```
+
+The compile step validates all `*.md` files in `.github/workflows/` against the gh-aw schema. It does not invoke Claude or make API calls.
+
+## Running staged smoke tests
+
+```bash
+# Run a single workflow against a fixture payload
+gh aw run issue-triage --staged --payload tests/aw/issue-triage/fixtures/new-bug.json
+
+# Run all smoke tests for a workflow
+bash tests/aw/issue-triage/smoke.sh
+```
+
+## Definition of Done checklist
+
+A workflow is ready to merge when:
+
+- [ ] Scenario specs written in `tests/aw/<name>/README.md` before implementation starts
+- [ ] `gh aw compile` passes with no errors
+- [ ] At least one fixture payload exists under `tests/aw/<name>/fixtures/`
+- [ ] Staged smoke test passes: `gh aw run <name> --staged` exits 0
+- [ ] CI lint job (`gh-aw-compile`) is green on the PR
+- [ ] Workflow markdown reviewed by a second author or the pr-reviewer agent