Add provider-scoped FlightCheck execution

[Surendra Goutham (is-goutham)]

Summary

Adds reusable execution context for provider-specific FlightCheck runs:

• merges an explicit provider config without overwriting foundation identity
• accepts a specific agent workspace slug
• uses a sidecar Dataverse endpoint only when foundation config has none
• reports skipped checks separately from passed checks

This is replacement PR 2 of the PR #290 split and is stacked on #300.

Validation

• python -m pytest tests/flightcheck/test_cli.py tests/flightcheck/test_cli_single_checkpoint.py tests/flightcheck/test_check_roles.py -q — 49 passed
• git diff --check

[nkemms]

Verdict: REQUEST CHANGES

1. MAJOR — --agent-slug is only assigned onto runner.agent_slug in solutions/ess-maker-skills/scripts/flightcheck/cli.py:954 and :1570, but nothing in the Workday checks reads that attribute. The actual consumers still derive the agent from runner.config["activeAgent"] / agent.slug (solutions/ess-maker-skills/scripts/flightcheck/checks/workday.py:415-430) and the workflow inventory still walks every workspace/agents/* directory (solutions/ess-maker-skills/scripts/flightcheck/checks/workday.py:5090-5114), so the new flag does not actually scope the run.

[Surendra Goutham (is-goutham)]

Fixed in ccbdd69 and propagated through the stack. Workday checks now resolve runner.agent_slug first: Copilot Studio links use the selected agent, and local Workday workflow discovery scans only workspace/agents/ when scoped. Added a two-agent regression proving the other agent is excluded.

[nkemms]

Updated review findings — merge blockers remain

• Major — malformed explicit agent scope can become a successful skip. Validation based on Path(agent_slug).name == agent_slug accepts ..; invalid or unresolved explicit scopes can then produce empty discovery and a successful SKIPPED result. Require a strict single path component and reject an invalid explicit --agent-slug as an input error.
• Major — provider config can overwrite foundation-owned state. _merge_connect_config copies arbitrary top-level provider fields except a partial denylist, allowing fields such as releaseLine to replace foundation run-mode identity. Use an explicit allowlist or namespace provider-owned fields rather than relying on a protected-key denylist.

[nkemms]

Re-reviewed the current head (926abc0) against its actual stacked base. Two blockers remain:

• --agent-slug .. escapes the selected-agent scope — solutions/ess-maker-skills/scripts/flightcheck/checks/workday.py:5096-5114: Path("..").name == "..", so the current basename check accepts the parent segment and scans above workspace/agents. Require a single valid slug segment and verify the resolved path remains a direct child of workspace/agents.
• Provider config can still override foundation-owned execution settings — solutions/ess-maker-skills/scripts/flightcheck/cli.py:710-745: the partial denylist permits fields such as releaseLine, powerPlatformApiEndpoint, and Workday probe configuration to change dispatch or retarget requests. Replace the denylist with an explicit provider-owned allowlist or namespace.

Selected-agent propagation for the ordinary valid-slug path is improved, but these input and ownership boundaries still prevent merge.

[Surendra Goutham (is-goutham)]

Addressed the latest blockers in 933bbb4: explicit agent slugs now use strict single-segment validation plus resolved direct-child containment, and provider config uses an explicit provider-owned allowlist. Validation: 774 FlightCheck check tests passed.

[nkemms]

Re-reviewed the latest head (933bbb4). The unsafe agent-slug handling and provider-overlay ownership issues are fixed through strict slug validation, direct-child path resolution, and an explicit provider-owned config allowlist.

I found no remaining critical blocker. Good to merge.

[nkemms]

Follow-up PR: When no active or explicitly selected agent exists, avoid falling back to the first agents[] entry for Workday custom-workflow inventory. Preserve the broad inventory behavior or require an explicit selection. This is not a blocker for this PR.

The base branch was changed.

[Surendra Goutham (is-goutham)]

PR #300 is merged. I retargeted this PR to main, merged the updated main into the branch, and reran the FlightCheck regression scope: 831 tests passed. The repository dismissed the prior approval after the base/head update; please re-review this now-current diff.

[Surendra Goutham (is-goutham)]

Main advanced with #326 after the prior approval. I merged the new main into this branch; the merge was clean and the expanded FlightCheck scope now passes 849 tests. Re-review requested for the current head.