dirsql-checks preflight reads a workflow the #834 split deleted, so just preflight cannot run #973

What

just preflight fails immediately on main. internals/checks/src/checks/preflight/cli.py still defaults --conventions to .github/workflows/conventions.yml, which #861 deleted when the #834 epic collapsed the per-concern workflows into per-domain ones:

@click.option(
    "--conventions",
    default=".github/workflows/conventions.yml",
    help="Workflow whose reusable-workflow callers define the gate matrix.",
)

cli opens that path unguarded, so the recipe dies with a bare FileNotFoundError rather than the actionable message every check is supposed to emit.

Why it is more than a stale string

preflight derives its matrix from one workflow file — parse_gate_matrix(text) over a single document. That was right when conventions.yml held every caller. Post-#834 the eight reusable-workflow callers are spread across six files:

So pointing the default at one surviving file would swap a crash for something worse: a green preflight that silently covers one lane. Passing --conventions <file> explicitly works today and is the only way to run it (that is how the gates were run while preparing #971 — one lane at a time), but nothing tells a contributor that, and just preflight with no arguments is what AGENTS.md instructs them to run before pushing.

The regression is invisible to CI by construction: preflight is a local-only tool, and its own colocated tests feed parse_gate_matrix inline YAML fixtures rather than the repo's real workflow files, so no test notices that the default path stopped existing.

Options

1. Accept a list of workflows, defaulting to every .github/workflows/*.yml that calls the reusable workflow — discovery rather than a hardcoded name, which is the same "derive, don't restate" principle dirsql-checks preflight: run CI's real gate matrix locally, derived from conventions.yml (not restated) #781 built the tool on and would survive the next workflow rename.
2. Accept repeatable --conventions, defaulting to the six files by name. Simpler, but restates a list that dirsql-checks preflight: run CI's real gate matrix locally, derived from conventions.yml (not restated) #781 exists to avoid restating.
3. Keep one file, fail loudly — at minimum, a missing --conventions target should name the file and the fix instead of raising FileNotFoundError, per the actionable-error rule.

(1) looks right. Whichever is chosen, the guard in (3) is worth having regardless.

A test that asserts the default target exists (or that discovery finds every caller in .github/workflows/) would have caught this and would catch the next rename; today's fixtures cannot.

Notes

• Surfaced while running the gates for ci: scope each binding's e2e freshness to its own package config #971 (e2e attestation scope: binding-crate changes don't stale their own SDK's attestation #933), where --conventions had to be passed per lane.
• Docs half only: Docs: post-#834 pass #932 item 1 already covers retiring the old workflow names from AGENTS.md and agents/reference/*. This issue is the code defect, which that pass does not touch.