Agents run the affected checks before they push #7795

This pull only covers the first half of #7787. A run's brief now tells it to run scripts/gate.ts before it pushes, but nothing stops a run from pushing without doing so. The measurement half is not started.

What changed: PUSH_STEPS_LINE in src/crew/brief.ts, the pre-push line in every non-planner crew brief, now says four things:

• When the clone has scripts/gate.ts, run bun scripts/gate.ts first. It catches the deterministic invariants, such as stale exclusions and missing migration pins, in under a second.
• After the gate, run bun x tsc --noEmit and the affected tests as before.
• Don't push while any of them is red. Fix it first, so the pull never exists red.
• If the sandbox can't run one of them, say which one and why in the last message.

test/crew-sandbox.test.ts now asserts the gate step, its position before the type check, the red rule and the sandbox-limit rule. I ran that file and the two crew-splits test files, which hash the brief, and they pass. tsc is clean. I did not run the full suite.

What I did not do:

• Enforcement: "Cannot finish its push without running" is only a brief instruction here. A real guard would have to hook the push path or a run-end check, which is a bigger change to how runs end and push.
• Measurement: The week-long comparison of first-check red rate and feedback rounds per landing needs data collected over that week. I changed no code for it, so the second checkbox stays open.
• gate.ts coverage: gate.ts covers only the invariants it implements. The audit's README-size and reserved-name failures only get caught if they live there or in the affected tests.

To try it: Run bun test test/crew-sandbox.test.ts.

🤖 Generated with Claude Code

Closes #7787

This pull only covers the first half of #7787. A run's brief now tells it to run scripts/gate.ts before it pushes, but nothing stops a run from pushing without doing so. The measurement half is not started.

What changed: PUSH_STEPS_LINE in src/crew/brief.ts, the pre-push line in every non-planner crew brief, now says four things:

• When the clone has scripts/gate.ts, run bun scripts/gate.ts first. It catches the deterministic invariants, such as stale exclusions and missing migration pins, in under a second.
• After the gate, run bun x tsc --noEmit and the affected tests as before.
• Don't push while any of them is red. Fix it first, so the pull never exists red.
• If the sandbox can't run one of them, say which one and why in the last message.

test/crew-sandbox.test.ts now asserts the gate step, its position before the type check, the red rule and the sandbox-limit rule. I ran that file and the two crew-splits test files, which hash the brief, and they pass. tsc is clean. I did not run the full suite.

What I did not do:

• Enforcement: "Cannot finish its push without running" is only a brief instruction here. A real guard would have to hook the push path or a run-end check, which is a bigger change to how runs end and push.
• Measurement: The week-long comparison of first-check red rate and feedback rounds per landing needs data collected over that week. I changed no code for it, so the second checkbox stays open.
• gate.ts coverage: gate.ts covers only the invariants it implements. The audit's README-size and reserved-name failures only get caught if they live there or in the affected tests.

To try it: Run bun test test/crew-sandbox.test.ts.

🤖 Generated with Claude Code