feat: implement issue #1202 — [Phase 1] safety-checks lib with sc_description_missing

.github/workflows/safety-checks-tests.yml

@@ -0,0 +1,79 @@
+# Quality gate for scripts/lib/safety-checks.sh — the sourceable PR-safety
+# signal helpers backing the Layer 1 spam-pr-guard scorer (epic #1200,
+# story #1202).
+#
+# Scope: tests sc_description_missing, which replaces the naive keyword grep
+# that let an unfilled PR template score 0/5 missing — the regression that
+# allowed combsmith/.github-private#1976 through automation.
+#
+# Pattern mirrors .github/workflows/agents-md-rules-tests.yml: pinned
+# actions/checkout, path-filtered triggers, read-only token, bats runner.
+# ShellCheck for the lib itself is covered by this workflow's bats "passes
+# shellcheck" case AND by ci.yml's org-wide ShellCheck job over scripts/**.
+
+name: Safety Checks Tests
+
+on:
+  pull_request:
+    paths:
+      - 'scripts/lib/safety-checks.sh'
+      - 'tests/test_safety_checks.bats'
+      - 'tests/fixtures/safety-checks/**'
+      - '.github/workflows/safety-checks-tests.yml'
+  push:
+    branches:
+      - main
+    paths:
+      - 'scripts/lib/safety-checks.sh'
+      - 'tests/test_safety_checks.bats'
+      - 'tests/fixtures/safety-checks/**'
+      - '.github/workflows/safety-checks-tests.yml'
+
+permissions: {}
+
+# github.sha scopes the concurrency group per-commit, not per-ref: a rapid
+# push sequence then cancels only its own in-flight run, so the LATEST
+# commit always keeps its own test result (otherwise a push-then-push race
+# cancels this run against the newer sha and the merged head has no test
+# evidence of its own).
+concurrency:
+  group: safety-checks-tests-${{ github.ref }}-${{ github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Validate PR-safety signal helpers
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+          # Read-only test job — never pushes; don't leave the token in git config.
+          persist-credentials: false
+
+      # Bounded retries so a transient apt mirror / DNS blip retries instead of
+      # failing the quality gate — same shape as .github/workflows/ci-tests.yml
+      # (the fleet convention for apt-based installs, issue #935 class).
+      - name: Install bats and shellcheck
+        run: |
+          set -euo pipefail
+          for attempt in {1..3}; do
+            if sudo apt-get update -qq \
+              && sudo apt-get install -y --no-install-recommends bats shellcheck; then
+              exit 0
+            fi
+            if [ "$attempt" -lt 3 ]; then
+              echo "Apt install failed, retrying in 5 seconds..." >&2
+              sleep 5
+            fi
+          done
+          echo "Apt install failed after 3 attempts" >&2
+          exit 1
+
+      - name: Run bats suite
+        run: |
+          bats --print-output-on-failure tests/test_safety_checks.bats

.markdownlint-cli2.yaml

@@ -5,6 +5,10 @@ ignores:
   # levels, dangling cross-references, …) so scripts/agents-md-lint.sh has a
   # negative case per failure mode. Linting them as real docs would always fail.
   - "tests/fixtures/agents-md/**"
+  # Safety-checks fixtures mimic real PR descriptions, including the
+  # unfilled-template body that motivated epic #1200 — they start at ## by
+  # design (PR bodies have no H1 title), so MD041 would always fire.
+  - "tests/fixtures/safety-checks/**"
 
 config:
   MD010: