ci: qualify goals + agent-runtime stack through Woodpecker + Dagger

[dporkka]

Purpose

Validation-only PR for the exact combined source tree of:

• feat(goals): add durable proof-bound goal slice #145 — proof-bound Goals (025_create_goals.sql)
• feat(agent-runtime): add append-only runtime event ledger #157 — append-only agent-runtime ledger (026_create_agent_runtime_event_ledger.sql)
• feat(agent-runtime): add ordered event sink chain #158 — ordered fail-closed event sink chain
• feat(agentexternal): add exact-head completion gate #159 — exact-HEAD external-run completion gate
• feat(agent-runtime): assemble durable external-agent bootstrap #160 — durable external-agent bootstrap
• ci: make Woodpecker + Dagger the portable validation lane #156 — Woodpecker + Dagger qualification files overlaid only for execution

Do not merge this PR as a flattening shortcut. Merge the actual feature stack in order after qualification.

Exact ancestry

The validation head descends from the real feature stack:

#145 -> #157 -> #158 -> #159 -> #160

and adds one final commit containing exactly #156's three CI files:

• .dagger/ci/verify.dag
• .woodpecker/README.md
• .woodpecker/dagger.yml

Head at creation: c8715718635720c34926fe965578cb8535f5f83f.

Why this PR targets main

.woodpecker/dagger.yml intentionally runs for pull_request events targeting main. This validation PR therefore targets main so the owned CI lane can execute the complete Goals + runtime stack without merging #156 or the feature stack first.

Required qualification order

1. First prove clean CI substrate ci: make Woodpecker + Dagger the portable validation lane #156 on its exact synchronized head.
2. Then require this PR's exact head to execute the same Woodpecker/Dagger lane.
3. Require the Dagger contract to reach a terminal source-validation result under Go 1.26.8 / Node 24.
4. Only after green evidence, use GitNexus on the exact intended worker-wiring head before modifying the existing worker composition root.

Current external blocker

As of 2026-10-06, ci.adacavo.com is demonstrably publishing Woodpecker statuses for dporkka/nulang-cloud, but dporkka/dev-plane receives no Woodpecker status even after a new synchronize commit on #156. This classifies the blocker as Dev Plane repository activation/webhook registration, above workflow and Dagger execution.

Operator repair is tracked in dporkka/nulang-cloud#176 and documented by deploy/woodpecker/REPOSITORY_ACTIVATION.md.

Merge policy

Do not merge this validation PR. After qualification:

1. merge/land feat(goals): add durable proof-bound goal slice #145 through its normal review path;
2. retarget feat(agent-runtime): add append-only runtime event ledger #157 to main and merge feat(agent-runtime): add append-only runtime event ledger #157 -> feat(agent-runtime): add ordered event sink chain #158 -> feat(agentexternal): add exact-head completion gate #159 -> feat(agent-runtime): assemble durable external-agent bootstrap #160 in order with exact-head validation;
3. qualify and merge ci: make Woodpecker + Dagger the portable validation lane #156 independently as the reusable CI substrate when its own clean canary is green;
4. close this validation-only PR.

[dporkka]

Qualification status — exact head c8715718635720c34926fe965578cb8535f5f83f

This validation head reproduces the same infrastructure diagnosis as clean CI canary #156:

• no Woodpecker commit status is present;
• GitHub Actions created Build/Lint/Test jobs but all three have runner_id=0, no runner, and zero executed steps;
• therefore no source command, migration, Go test, lint, build, or Dagger step executed.

This is not evidence against the Goals + agent-runtime source stack. Keep this PR draft and do not modify the Dagger contract in response.

Next authority remains the operator-side Dev Plane Woodpecker activation/webhook repair tracked in dporkka/nulang-cloud#176. After #156 receives a real Woodpecker status on a post-repair synchronize SHA, retrigger this PR and require exact-head Dagger execution.