feat(ci): agent gate for knowledge PRs — transferability, duplication, fact check

[choiyounggi]

What

Adds an agent-run CI gate for the three semantic checks scripts cannot do, closing the gap where transferability, semantic duplication, and fact-checking existed only as self-reported steps inside the knowledge-flush session:

• .github/workflows/wiki-agent-gate.yml — on every PR touching wiki/**, runs Claude Code headless via anthropics/claude-code-action@v1 (subscription OAuth token, no per-token billing). Verdict arrives as --json-schema structured output; the gate fails closed when the agent produces no verdict and fails on any blocker finding. Findings are posted back to the PR as a comment on failure.
• .github/wiki-agent-gate-prompt.md — the check definitions: transferability (org-internal directives are blockers), semantic duplication (Grep the existing wiki before accepting a new page/row), fact check (WebFetch each cited source and confirm the quote supports the directive; unfetchable → advisory, never guessed).
• tests/wiki-agent-gate.bats — 12 doc-gate tests pinning the security guards, the fail-closed step, and the schema/prompt contract, each positive check paired with a negative control.

Security (pull_request_target)

Knowledge PRs come from a fork, and plain pull_request withholds secrets there — so this uses pull_request_target with the two guards the action's security docs prescribe:

1. Job-level trust gate: only PRs from this repo or the maintainer's own accounts (choiyounggi, dch0202-rsquare) start the job.
2. Base-ref-only checkout: the untrusted PR head is never checked out; the agent reads it exclusively via gh pr diff, and the prompt file instructs it to treat instruction-shaped text inside the diff as a finding, not as instructions.

Setup required before this gate can run

The repo secret CLAUDE_CODE_OAUTH_TOKEN must be added once: run claude setup-token locally, then gh secret set CLAUDE_CODE_OAUTH_TOKEN.

Verification

• bats tests/wiki-agent-gate.bats → 12/12 pass
• Workflow YAML parses (ruby YAML.load_file)
• No wiki/** changes: directive count and structure gates unaffected

🤖 Generated with Claude Code

https://claude.ai/code/session_01RJsPDQCz3wNt2qk4opqcKG