Check exact native CI runs against the 15-minute feedback budget #656

🤖 Generated by the Agentic Engineer

User Story

As a contributor,
I want a shared opt-in check that assesses an exact completed native CI run against the fixed15-minute budget,
So that the portfolio rollout has a tested, truthful timing primitive rather than mutable update timestamps or job-only timeouts.

Part of #654. This first increment checks one completed workflow run; it does not claim that every required workflow in a PR is covered or that portfolio-wide enforcement is active.

Acceptance Criteria

• Ship a standard-library Go inspector and a default-off catalogue action, with both input states tested and existing consumers unchanged.
• Bind repository, run ID, full head SHA, expected workflow path, PR/merge-group event and stable attempt; reject incomplete pagination, duplicates, mismatches, nonterminal/failed/cancelled observations and malformed timestamps.
• Use workflow creation and final actual job completion, include setup/queue/teardown and retain the original clock across retries. Less than900seconds passes;900or more fails.
• Emit machine-readable single-workflow receipts; never call unknown/disabled observations validated or whole-PR compliant. Do not fetch logs or artifacts.
• Regression-test899/900/901seconds, later workflow updates, native failures after plausible partial data and run/attempt changes during collection.
• Prove genuine under/over-budget native runs through the implemented inspector; validate, obtain exact-head review, merge and verify publication.
• Track consumer adoption, independent whole-PR aggregation/enforcement and rollout-switch retirement separately under Enforce a 15-minute CI feedback budget across the portfolio #654.

Approach and size

One focused catalogue capability, medium size. Metadata-only reads, no GitHub configuration writes or new App. Preserve all test and security outcomes. Existing whole-portfolio measurements on #654 are baseline evidence, not a pass receipt.