test(generate): generation-correctness census forcing suite

[joshua-temple]

Problem

PR #631's emitted-field census forces every emitted-affecting manifest field into actionlint coverage: the emitted output is VALID (real GitHub accepts it at parse). Validity is not correctness. A documented feature can emit valid YAML that does the WRONG thing (a matrix deploy that drops sha, a dry_run guard blind to a boolean, a dependent deploy gated on the immutable base result). Those defects are invisible to actionlint, act, and reviews because no test asserts the emitted output's semantic shape. Ad-hoc assertions exist for a handful of past defects, but there is no systematic, census-forced correctness coverage, so the next feature nobody asserts escapes silently.

Fix

A correctness census that reuses #631's emitted-affecting surface (the union of emittedFieldRegistry and emittedAffectingAllowlistMutators) and forces every field into exactly one classification:

• a named correctness assertion pinning its emitted semantic shape, or
• a reviewed marker: validity-only (contract is validity + round-trip, already covered), structural (pinned by a sibling's assertion), not-emitted, or followup (emitted-affecting, warrants an assertion not yet written).

TestCorrectnessCensus_EveryEmittedFieldClassified reds when a new emitted-affecting field appears unclassified (proven by TestCorrectnessCensus_ForcesNewField against a synthetic field), mirroring how TestActionlint_AllowlistFieldsClassified already forces validity classification. TestCorrectnessCensus_AssertionsExist grounds every named assertion in a real test function, so a typo cannot leave an entry pointing at nothing.

Assertions added (each proven red-first)

Each was verified by breaking its emitter, watching the test red, and restoring:

• least-privilege per-job permissions (a job with no configured perms emits no block; scopes never leak across jobs)
• secrets.map propagation direction (callee input maps to the source secret expression, not reversed)
• concurrency cancel-in-progress honored (not defaulted)
• action_pins ref splicing into uses:
• dispatch input typing (type/options/default)
• extra_triggers schedule/repository_dispatch/workflow_run emission
• custom git identity splicing
• environments[].environment_url per-environment case threading

Honest limit

A generation-correctness assertion pins the shape the author believes correct. It catches a missing key, a wrong-versus-baseline expression, and a regression. It does NOT prove the shape is correct against real GitHub Actions runtime semantics (whether != 'true' rescues a boolean dry_run, whether a retry shim rescues a failed ladder). That proof is the fleet's job. The runtime-semantic assertions say so in-test and defer to the fleet.

Remaining-fields followup

The followup-marked fields are the enumerated backlog for the next tranche: run_policy if-gates (builds/deploys/validate), build-side and optional depends_on gating, role ladder ordering, GPG signing wiring, pin_mode, release_trigger, and reconcile source/commit output. The census red state tracks them.

Verification

• go build ./..., go test ./... (3614 pass, actionlint on PATH so fix(generate): enforce emitted-workflow validity; reject on_failure continue, gate hotfix inputs #631's guard runs), go test ./internal/generate -race, golangci-lint run ./... all clean.
• cascade verify --own-repo: no drift.
• fix(generate): enforce emitted-workflow validity; reject on_failure continue, gate hotfix inputs #631's actionlint guards stay green (236 census/actionlint tests pass).

Test-only; not fleet-relevant (no emitter changed).