Require AI harness lint before commits

Author: anth-volk

docs/engineering/skills/github-prs.md

@@ -24,3 +24,17 @@ For migration work, identify:
 - what is newly prepared for FastAPI, SQLAlchemy/Alembic, Supabase, Cloud Run,
   or Modal migration;
 - which user-visible API contract changes are intentionally introduced.
+
+## Commit Hygiene
+
+AI agents must run formatting and lint checks before committing their own code
+changes:
+
+```bash
+make format
+ruff check <changed Python files>
+```
+
+Commit only after formatting succeeds and changed Python files pass lint. If a
+broader repo-wide lint command fails on unrelated pre-existing issues, include
+that result in the handoff instead of hiding it.

docs/engineering/skills/testing.md

@@ -70,5 +70,13 @@ fixture; smoke tests must not create or update households:
 API_BASE_URL=https://candidate-url python -m pytest tests/integration/test_cloud_run_candidate.py -v
 ```
 
-Run `ruff format --check` and `ruff check` on changed Python files before
-handoff.
+Before committing AI-authored code changes, run repository formatting and lint:
+
+```bash
+make format
+ruff check <changed Python files>
+```
+
+Commit only after formatting succeeds and changed Python files pass lint. If a
+broader repo-wide lint command fails on unrelated pre-existing issues, include
+that result in the handoff instead of hiding it.

tests/unit/test_cloud_run_deploy_scripts.py

@@ -269,8 +269,7 @@ def test_push_workflow_uses_dedicated_cloud_run_runtime_service_account():
         "${{ secrets.GCP_CLOUD_RUN_RUNTIME_SERVICE_ACCOUNT }}"
     )
     deploy_account_secret = (
-        "CLOUD_RUN_RUNTIME_SERVICE_ACCOUNT: "
-        "${{ secrets.GCP_DEPLOY_SERVICE_ACCOUNT }}"
+        "CLOUD_RUN_RUNTIME_SERVICE_ACCOUNT: ${{ secrets.GCP_DEPLOY_SERVICE_ACCOUNT }}"
     )
 
     assert runtime_account_secret in cloud_run_staging