ci: report gate skips as SKIP, and a deleted baseline as a failure

[justinjoy]

Refs #1301. Third instance of this defect class (#1288 fixed check-release-template.sh, #1302 the wl_log_emit provenance check), so the guard here is shared rather than per-gate.

The defect

Five meson-registered gates printed SKIP: … and exited 0. Meson reads exit 0 as a pass, so each was recorded as having asserted something it never looked at.

check-abi-manifest.sh · check-abi-symbols.sh · check-abi-symbols-locale.sh · check-abi-symbols-macos.sh · check-sbom-snapshot.sh

All five are reached only through tests/meson.build. 77 is safe under meson and not under a bare workflow run: step, where GitHub's bash -e fails the job — each header now says so.

Two branches go the other way, to exit 1

abi/libwirelog-1.0.abi.json and sbom/snapshot.txt are committed, so absence means a baseline was deleted, not that the build can't answer. check-abi-symbols.sh has always treated a missing allowlist as a hard failure — three gates were giving three verdicts for one condition.

Both sit behind their tool probes, so exit 1 is only reachable on a host that could otherwise have checked; the release tarball ships both files; and every downstream/upgrade consumer builds -Dtests=false, so these gates aren't even registered there.

In check-abi-manifest.sh the baseline check deliberately precedes the arm64 arch skip: a deleted baseline is true on every architecture at once, so severity outranks environment, and the order makes the arm64 leg a second detector rather than a blind spot.

One deliberate inconsistency

check-abi-symbols-macos.sh keeps exit 0 for a missing allowlist. That gate reports real symbol drift as a warning, so a missing allowlist — strictly less informative than drift — cannot carry a harsher status than the drift itself; and 77 would show SKIP for "no allowlist" beside OK for "the symbols diverged."

The rule the file now states: 77 means the environment cannot supply the input; once it can, the gate's own severity applies.

#1301 contradicts itself here: its out-of-scope section names :46 and :70 as advisory by design, its exit-1 section names :48 — the same branch's exit. The out-of-scope reading is coherent, and that adjudication is recorded next to the branch.

The shared guard

Partitions every meson-registered check script into COVERED (16) or EXEMPT (3, each with a reason) and fails when one is neither. Listing the ten already-clean gates is the point — a list of only the broken ones couldn't guard them.

One exemption is honest rather than principled: check-release-template.sh has the defect and is exempted only because #1288 fixes it on another branch. It's labelled as the one entry failing the file's own rule, with a TODO to promote it.

Four defects found in the guard itself

Three are the same class this PR exists to fix:

defect	consequence
git fixture used cd, but GIT_DIR overrides it	committed the caller's uncommitted work while printing "all cases passed"; with GIT_DIR alone, deletes the tracked tree. It fired against this worktree during review. Also unnecessary — the gate invokes git zero times
grep -A | grep -q under pipefail	grep -q kills its producer; reported "no defect" on a large file
the obvious repair, printf | grep -c	failed identically — grep -c returns 1 on a zero count, and || true can't distinguish that from a producer dying at 141. Removing the pipeline, not hardening it, was the fix
the coverage guard was fail-open	a scan matching nothing reported success — this PR's own defect one level up

Each now has a mutation that kills it.

Validation

• abi suite 42 Ok / 0 Fail / 0 Skipped on Linux x86_64 with abidiff and syft present — nothing that could enforce was downgraded; a patch turning everything into 77 would show up here
• full suite 305 Ok / 0 Fail / 12 Skipped (all skips pre-existing)
• 30 assertions; mutation-tested including both exit-1 conversions, the arm64 arch-skip, three quote/printf evasion shapes, uppercase and underscore gate names, and an empty scan
• the backstop's window has 18 lines of false-positive slack but only one line against false negatives; the comment states the one-line figure, verified empirically (gap=6 caught, gap=7 evades)

Three review rounds; final verdicts Reviewer, Architect and Critic all approving.