feat(check): gate managed output content

[jdh313]

Ports the two content gates that jdh-agents currently runs outside the compiler (marketplace scan, marketplace lint) into agentforge check, so a consumer repo no longer needs its own Python tooling to know whether a compiled tree is publishable.

Both gates ride on the byte read checkManagedOutput already performs for the drift comparison, so copied passthrough resources are covered, not just generated documents — at no extra I/O. Nothing previously read those bytes for anything but equality.

Commits

1. feat(check): gate managed output content on declared redactions — new unsafe-output-content issue. Flags absolute home directories (/Users/<name>/, /home/<name>/) and any literal string a marketplace declares under a new optional redactions: block.
2. feat(check): report a managed .json output that does not parse — new invalid-output-document issue for a .json output that is not one of the native documents.

Design notes

• Redactions are literal strings, not patterns. A declaration names a vocabulary; a regex invites an author to encode matching logic the compiler then has to defend against (backtracking, silent over-match). The one patterned class that generalizes across every repository — the home directory — is built in, where it is tested once. Follows the authoring-keys / documents precedent (ndr:4nshwv).
• Carried on the plan, not passed alongside it. check derives every judgement from the compilation plan (ndr:tfee0d); a gate handed in as a separate optional argument is a gate a caller can forget — the same reasoning that keeps rootOutputs on the plan.
• Gates on check, never on compile. Compilation stays total. A leak that reaches disk under --out has not been published; one that survives check is about to be.
• Deliberately narrower than the linter it replaces. Empty-markdown, short-markdown, and the allowed-extension list did not port: none is a runtime failure on either harness, and turning one repository's house style into every consumer's build error is the overreach ndr:17dhph rejected for strict target schemas. Two tests pin that tolerance.
• Not ported, and cannot be: the repo-wide sweep over every git-tracked file. agentforge only ever sees files a publication declares, so that stays a publishing repo's own pre-push hook.

Risk surface

Low. Both gates are additive to check and touch no compile or materialize path — output bytes are unchanged, and bun test snapshots are untouched (67 unchanged). The only breaking shape is CompilationPlan.redactions being required rather than optional, which is deliberate: the type surfaces every construction site rather than letting one silently skip the gate.

The realistic failure mode is a false positive failing a consumer's build. Mitigated by scoping the built-in detector to absolute home paths only — secret-shaped detection was deliberately left out, since it belongs to the repo-wide scan that stays put.

Testing

• 167 pass / 0 fail, typecheck and biome clean.
• 7 new tests, including two negatives (an undeclared sensitive-looking string passes; an empty markdown resource passes) and a binary-payload skip.
• Verified against both real consumer corpora with zero false positives: jdh-agents 420 managed files, ndr 77 managed files, all ok.
• Each commit verified green independently before the next was layered on.

Rollback

Revert either commit alone — they are independent gates sharing only the read site. Reverting both restores check exactly.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LxNdWk6ZUzq6uWFtd94yWD

[github-actions]

🎉 This PR is included in version 0.3.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀