Add a CI quality gate for evaluation specs and fixtures

[Evangelink]

Split out of #945 at review request: this is repo-wide infrastructure (the workflow gates every plugin, and its warnings cover fixtures and skills in plugins that PR does not own), so it has a different blast radius and a different reviewer set from the dotnet-test content fixes.

⚠️ Stacked on #945 — base is dev/amauryleve/dotnet-test-eval-followups, not main

This gate requires the #950 Cobertura fixture fix, which lives in #945. It is not
duplicated here — this PR inherits it through its base branch.

Against today's main the gate exits 1 with exactly six errors, all of them the
inconsistencies #945 corrects:

coverage-analysis/fixtures/partial-coverage: Enroll, CalculateGpa, Search
crap-score/fixtures/partial-coverage:        ProcessOrder, GetOrderStatus, CancelOrder

Branching off main would therefore open this PR red and unmergeable. Stacking keeps it
green, and #945 is unaffected — it targets main and merges independently. GitHub
retargets this PR's base to main automatically once #945 lands, at which point the
diff and the result are unchanged.

The diff against the base is exactly the four files above; nothing from #945 appears in it.

Why

Every defect class here was found the hard way in #945: as a skill mysteriously losing to its own baseline, with the eval specs parsing cleanly and skill-validator passing throughout. An audit of all 97 eval specs quantified the wider picture:

Finding	Scale
Skills with no eval at all	5
Evals at n=1 (a single judge call decides pass/fail)	18
Evals at n=2	10
Evals at n=3	21
Underpowered (n≤3) of 93 skill evals	49 (53%)
Orphaned fixtures (committed, never referenced)	12
Cobertura methods whose line-rate contradicts own <lines>	6

None of this was visible to any existing check.

What fails the build

All four are structural — they inspect file existence, git state, or YAML keys, never prose — so they cannot fire spuriously on a well-written eval.

1. A referenced fixture missing on disk.

2. A referenced fixture not tracked by git. .gitignore carries coverage*.xml (correct for Coverlet output) and silently swallowed a committed Cobertura fixture. git add -A reported success, the eval passed locally, and three scenarios would have failed at setup in CI. Verifying against the working tree cannot catch this — only the git index can.

3. A Cobertura fixture whose declared line-rate contradicts its own <lines>. The crap-score skill documents both parse paths, so the two arms of a comparison can legitimately read different coverage inputs and the eval measures the disagreement instead of the skill. Observed live — a scenario lost −40% with the judge writing:

   "Response B made a critical error by manually counting line hits (12/15 = 80%) instead of using the XML's recorded line-rate of 0.55"

   The fixture was wrong, not the response.

4. A dormancy guard (expect_activation: false) that also sets reject_skills. That forces the skilled arm skill-free, making it identical to the baseline arm, so the head-to-head score is pure judge noise. The same guard scored −0.4, +0.4, +0.4 and 0 across four evals, and twice cost a skill its pass.

What only warns

Statistical power, orphaned fixtures, uncovered skills, and dormancy guards that appear to lack an anti-hijack rubric item.

Two deliberate calls:

• The anti-hijack check began as an error and immediately false-positived on a well-formed guard in system-text-json-net11 whose rubric reads "Does NOT load or reference the system-text-json-net11 skill". Detecting that property needs phrase matching over free text and will always have false positives, so it warns. A gate that blocks a PR spuriously is a gate the team switches off.
• Failing on power would break 28 existing evals across 8 plugins, and the fix (raising runs) is a CI cost decision — see Eval gate is underpowered: 27% of verdicts flip on byte-identical inputs (A/A test); 53% of evals run at n<=3 #952, which argues against a blanket runs: 3 because the dotnet-test job already takes ~75 min against a 360-min cap.

The gate is self-testing

selftest_eval_quality.py injects each defect into a scratch tree, asserts the gate rejects it, then asserts a clean tree passes:

[OK ] clean tree                                       expected=PASS got=PASS
[OK ] fixture referenced but missing on disk           expected=FAIL got=FAIL
[OK ] fixture present but NOT tracked by git           expected=FAIL got=FAIL
[OK ] Cobertura line-rate contradicts its <lines>      expected=FAIL got=FAIL
[OK ] dormancy guard also sets reject_skills           expected=FAIL got=FAIL
[OK ] well-formed dormancy guard                       expected=PASS got=PASS

CI runs the self-test before the gate, so the gate cannot silently stop working.

Checks

• eval-quality workflow verified green in real CI on Fix dotnet-test findings from the refreshed cross-family eval (#899) #945 before the split
• actionlint clean on the new workflow
• markdownlint clean on the README
• 0 errors across 97 specs on this base

Refs #899, #952.

[github-actions]

✅ Evaluation passed for 9b62611. cc @ViktorHofer @JanKrivanek — please review.