Harden CI-fixer discovery and safe-output transport

.github/scripts/Register-CiFixSafeOutputExpectation.Tests.ps1

@@ -0,0 +1,49 @@
+#!/usr/bin/env pwsh
+#Requires -Modules Pester
+
+Describe 'Register-CiFixSafeOutputExpectation' {
+    BeforeEach {
+        $script:outputDirectory = Join-Path $TestDrive "expectations-$([Guid]::NewGuid().ToString('N'))"
+        $script:scriptPath = Join-Path $PSScriptRoot 'Register-CiFixSafeOutputExpectation.ps1'
+    }
+
+    It 'registers a PR-targeted safe output as bounded JSON' {
+        & $script:scriptPath `
+            -Type push_to_pull_request_branch `
+            -PullRequestNumber 36619 `
+            -OutputDirectory $script:outputDirectory | Out-Null
+
+        $files = @(Get-ChildItem -LiteralPath $script:outputDirectory -Filter '*.json')
+        $files.Count | Should -Be 1
+        $expectation = Get-Content -Raw -LiteralPath $files[0].FullName | ConvertFrom-Json
+        $expectation.type | Should -Be 'push_to_pull_request_branch'
+        $expectation.pullRequestNumber | Should -Be 36619
+    }
+
+    It 'requires a PR number for PR-targeted outputs' {
+        {
+            & $script:scriptPath -Type add_comment -OutputDirectory $script:outputDirectory
+        } | Should -Throw '*PullRequestNumber is required*'
+    }
+
+    It 'does not accept a PR number for create_pull_request' {
+        {
+            & $script:scriptPath `
+                -Type create_pull_request `
+                -PullRequestNumber 36619 `
+                -OutputDirectory $script:outputDirectory
+        } | Should -Throw '*must be omitted*'
+    }
+
+    It 'registers report_incomplete without a PR target' {
+        & $script:scriptPath `
+            -Type report_incomplete `
+            -OutputDirectory $script:outputDirectory | Out-Null
+
+        $expectation = Get-Content -Raw -LiteralPath (
+            Get-ChildItem -LiteralPath $script:outputDirectory -Filter '*.json'
+        )[0].FullName | ConvertFrom-Json
+        $expectation.type | Should -Be 'report_incomplete'
+        $expectation.pullRequestNumber | Should -BeNullOrEmpty
+    }
+}

.github/scripts/Register-CiFixSafeOutputExpectation.ps1

@@ -0,0 +1,43 @@
+#!/usr/bin/env pwsh
+<#
+.SYNOPSIS
+    Registers a CI-fixer safe output that the agent is about to emit.
+#>
+
+param(
+    [Parameter(Mandatory = $true)]
+    [ValidateSet(
+        'create_pull_request',
+        'push_to_pull_request_branch',
+        'update_pull_request',
+        'add_comment',
+        'mark_pull_request_as_ready_for_review',
+        'add_labels',
+        'noop',
+        'report_incomplete'
+    )]
+    [string]$Type,
+    [ValidateRange(1, [int]::MaxValue)]
+    [int]$PullRequestNumber,
+    [string]$OutputDirectory = '/tmp/gh-aw/agent/ci-fix-output-expectations'
+)
+
+$ErrorActionPreference = 'Stop'
+
+$nonPrTypes = @('create_pull_request', 'noop', 'report_incomplete')
+if ($Type -notin $nonPrTypes -and $PullRequestNumber -le 0) {
+    throw "PullRequestNumber is required for safe output type '$Type'."
+}
+if ($Type -in $nonPrTypes -and $PullRequestNumber -gt 0) {
+    throw "PullRequestNumber must be omitted for safe output type '$Type'."
+}
+
+New-Item -ItemType Directory -Force -Path $OutputDirectory | Out-Null
+$expectation = [ordered]@{
+    type = $Type
+    pullRequestNumber = if ($PullRequestNumber -gt 0) { $PullRequestNumber } else { $null }
+    registeredAt = (Get-Date).ToUniversalTime().ToString('o')
+}
+$path = Join-Path $OutputDirectory "$([Guid]::NewGuid().ToString('N')).json"
+$expectation | ConvertTo-Json -Compress | Set-Content -LiteralPath $path -Encoding UTF8
+Write-Output $path