ci: add launcher-standard prose↔a2ml lock-step gate (#172)

## Summary

`launcher/README.adoc` §Sync requirement declares that the
machine-readable form (`launcher/launcher-standard.a2ml`) and the prose
form (`docs/UX-standards/launcher-standard.adoc`) MUST be edited in the
same PR, and calls drift between them a *"standards-compliance bug"* —
but nothing enforced the rule. The recently-fixed cross-doc
contradictions in
[#170](#170)
were exactly the drift this rule was meant to prevent.

This adds `.github/workflows/launcher-standard-lockstep.yml` — a hard
gate that runs on every PR touching either file. If only one is in the
diff, it fails with a message naming the missing partner and pointing
back at §Sync requirement.

## How it works

\`\`\`yaml
on:
  pull_request:
    paths:
      - 'launcher/launcher-standard.a2ml'
      - 'docs/UX-standards/launcher-standard.adoc'
\`\`\`

GitHub's `paths:` filter ensures the workflow only triggers when one of
the two files is touched (cheap — no wasted runs for unrelated PRs).
Inside the job, a 30-line bash check diffs `pull_request.base.sha`
against `pull_request.head.sha`, computes which of the two files are
*touched* vs *missing*, and fails iff the touched set is non-empty but
incomplete.

## Dry-run verification

Logic dry-run locally against six synthetic diffs:

| Diff | Expected | Result |
|------|----------|--------|
| only a2ml touched         | FAIL — drift | FAIL ✓ |
| only adoc touched         | FAIL — drift | FAIL ✓ |
| both touched              | PASS         | PASS ✓ |
| both touched + unrelated  | PASS         | PASS ✓ |
| neither touched | skip (no trigger) | workflow doesn't run ✓ |
| a2ml + unrelated (drift)  | FAIL — drift | FAIL ✓ |

## Pattern conformance

Modelled on the existing `makefile-blocker.yml` gate:

- Same SPDX header.
- Same `actions/checkout@de0fac2…` pin (verified live against
  `github.com/actions/checkout` — corresponds to v4 commit
  `de0fac2e4500dabe0009e67214ff5f5447ce83dd` "Fix tag handling" #2356).
- Same `concurrency` block that cancels superseded runs (safe — this is
  a read-only check, no mutations).
- Same `permissions: contents: read`.

## Scope notes

- **Initial group is the 2-file pair** the README literally calls out.
  Once [#171](#171)
  lands and introduces `launcher/resolve-desktop-tools.sh`, a follow-up
  should extend the group to include the resolver (which mirrors
  `[resolution]` in the a2ml and currently relies on reviewer
  discipline).
- **Hard fail, not warning.** The README uses "MUST" / "is a bug"
  language; the gate matches that strictness. Genuinely one-sided
  edits (e.g. a prose-only typo fix with no a2ml equivalent) need a
  no-op whitespace touch to the other file — the error message
  documents this escape.
- **Not added to required-checks list.** Branch-protection config
  lives outside the repo. Owner can promote this to a required check
  via the UI or `.github/settings.yml` once they've seen it pass green
  on a few PRs.

## Coordination

- Fully independent of #170 and #171 — touches a different file
  (`.github/workflows/launcher-standard-lockstep.yml`). No conflicts
  in any merge order.

## Test plan

- [x] Dry-run against 6 synthetic diff scenarios — all expected outcomes
- [x] actions/checkout SHA pin verified live
- [x] YAML syntactically valid (workflow loads — visible in Actions tab
      once branch is pushed)
- [ ] First live trigger will happen when PR #170 or #171 next pushes
      and touches a group file — at that point this gate's run will
      appear on those PRs

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/launcher-standard-lockstep.yml

@@ -0,0 +1,98 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+name: launcher-standard lock-step
+
+# Enforces the sync requirement declared in launcher/README.adoc §Sync
+# requirement: the machine-readable form (launcher-standard.a2ml) and the
+# prose form (docs/UX-standards/launcher-standard.adoc) MUST be edited in
+# the same PR. Drift between the two is a standards-compliance bug.
+#
+# How it works: the workflow triggers only when one of the two files in
+# the lock-step group is touched. Inside the job we then verify that the
+# other file is *also* in the PR diff. If not, fail with an actionable
+# message naming the missing file.
+
+on:
+  pull_request:
+    paths:
+      - 'launcher/launcher-standard.a2ml'
+      - 'docs/UX-standards/launcher-standard.adoc'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lockstep:
+    name: Verify launcher-standard lock-step
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout (full history for base/head diff)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+        with:
+          fetch-depth: 0
+
+      - name: Verify both files changed
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+
+          # The lock-step group. Editing any of these MUST be accompanied
+          # by edits to the others in the same PR.
+          declare -a GROUP=(
+            "launcher/launcher-standard.a2ml"
+            "docs/UX-standards/launcher-standard.adoc"
+          )
+
+          mapfile -t CHANGED < <(git diff --name-only "${BASE_SHA}" "${HEAD_SHA}")
+
+          declare -a TOUCHED=()
+          declare -a MISSING=()
+          for f in "${GROUP[@]}"; do
+            found=0
+            for c in "${CHANGED[@]}"; do
+              if [[ "$c" == "$f" ]]; then
+                found=1
+                break
+              fi
+            done
+            if [[ $found -eq 1 ]]; then
+              TOUCHED+=("$f")
+            else
+              MISSING+=("$f")
+            fi
+          done
+
+          # If the workflow ran, paths: filter matched at least one group
+          # member — so TOUCHED is non-empty. The check is whether MISSING
+          # is also non-empty (partial-touch = drift).
+          if [[ ${#MISSING[@]} -gt 0 ]]; then
+            echo "::error::launcher-standard lock-step violation"
+            echo ""
+            echo "Per launcher/README.adoc §Sync requirement, the machine-readable"
+            echo "form (a2ml) and the prose form (adoc) MUST be edited in the"
+            echo "same PR. Drift between them is a standards-compliance bug."
+            echo ""
+            echo "Touched in this PR:"
+            for f in "${TOUCHED[@]}"; do
+              echo "  + ${f}"
+            done
+            echo ""
+            echo "Required but NOT touched:"
+            for f in "${MISSING[@]}"; do
+              echo "  - ${f}"
+            done
+            echo ""
+            echo "Fix: add the matching edit to the file(s) above. If your"
+            echo "change is genuinely one-sided (e.g. a prose-only typo fix"
+            echo "with no a2ml equivalent), add a no-op whitespace touch to"
+            echo "the other file with a commit message explaining why."
+            exit 1
+          fi
+
+          echo "::notice::launcher-standard lock-step: OK — both files touched"
+          printf '  + %s\n' "${TOUCHED[@]}"