harden(go-migration): require upstream APM freshness

[mrjf]

Description

Harden migration parity enforcement by requiring upstream APM freshness/contract coverage during enforcing runs.

Follow-up CI fix: updated the migration workflow unit test to match the current env-based enforcement logic in .github/workflows/migration-ci.yml (manual enforce_completion input and crane/* branch detection).

Type of change

• Bug fix
• New feature
• Documentation
• Maintenance / refactor

Testing

• Tested locally
• All existing tests pass
• Added tests for new functionality (if applicable)

[github-actions]

Migration Benchmark Results

• Commit: e11293851bda6589da50176e042c3c7e19a6acac
• Run: https://github.com/githubnext/apm/actions/runs/27361652751

Migration CLI Benchmark

Includes fixture-backed commands that must read, write, execute, or fail against real project state. The installed-project fixture contains apm.yml, apm.lock.yaml, apm_modules packages, local .apm primitives, target directories, deployed prompt files, and sample source files.
The harness checks return-code parity for each command. Detailed stdout/stderr byte counts are kept in the JSON samples, but this is not an output-parity test.

Max allowed Go/Python median ratio: 5.00

Benchmark	Command	Fixture	Python median	Go median	Go/Python	Result	Return codes
init scaffold	init --yes	empty-project	0.3863s	0.0012s	0.00x	328.97x faster	{'python': [0], 'go': [0]}
targets json	targets --json	installed-project	0.3746s	0.0014s	0.00x	266.42x faster	{'python': [0], 'go': [0]}
script list	list	installed-project	0.3743s	0.0013s	0.00x	286.94x faster	{'python': [0], 'go': [0]}
deps list	deps list	installed-project	0.3793s	0.0013s	0.00x	302.72x faster	{'python': [0], 'go': [0]}
deps tree	deps tree	installed-project	0.3772s	0.0014s	0.00x	271.20x faster	{'python': [0], 'go': [0]}
install local package	install --no-policy ./packages/local-tools	local-install-project	0.4079s	0.0013s	0.00x	303.26x faster	{'python': [0], 'go': [0]}
compile copilot target	compile --target copilot	compilation-project	0.3905s	0.0012s	0.00x	316.60x faster	{'python': [0], 'go': [0]}
pack output	pack --output dist	installed-project	0.3905s	0.0013s	0.00x	290.90x faster	{'python': [0], 'go': [0]}
run script	run stamp	runnable-project	0.3768s	0.0018s	0.00x	206.50x faster	{'python': [0], 'go': [0]}
audit hidden unicode	audit --ci	audit-finding-project	0.3885s	0.0015s	0.00x	252.35x faster	{'python': [1], 'go': [1]}

Workloads

• init scaffold: Creates a new apm.yml in an otherwise empty project directory.
• targets json: Reads configured project targets from apm.yml and emits machine output.
• script list: Reads apm.yml scripts and renders the runnable script inventory.
• deps list: Scans apm_modules package directories and apm.lock.yaml metadata.
• deps tree: Builds a dependency tree from apm.lock.yaml and installed package metadata.
• install local package: Installs a local package and materializes lock/module state.
• compile copilot target: Discovers local primitives and writes the Copilot target artifact.
• pack output: Resolves local package contents and writes a distributable artifact.
• run script: Executes a project script and writes the script's side-effect file.
• audit hidden unicode: Scans a real installed file and fails on planted hidden Unicode.

[mrjf]

@copilot fix ci

[Copilot]

@copilot fix ci

Fixed in d9c9633. I updated the failing migration CI workflow unit test assertion to match the env-based enforce_completion logic used in .github/workflows/migration-ci.yml, and re-ran the targeted test plus repo lint checks.

[github-actions]

Migration Benchmark Results

• Commit: d9c96335ec54b48b524989ab9077b2c682b52633
• Run: https://github.com/githubnext/apm/actions/runs/27378605826

Migration CLI Benchmark

Includes fixture-backed commands that must read, write, execute, or fail against real project state. The installed-project fixture contains apm.yml, apm.lock.yaml, apm_modules packages, local .apm primitives, target directories, deployed prompt files, and sample source files.
The harness checks return-code parity for each command. Detailed stdout/stderr byte counts are kept in the JSON samples, but this is not an output-parity test.

Max allowed Go/Python median ratio: 5.00

Benchmark	Command	Fixture	Python median	Go median	Go/Python	Result	Return codes
init scaffold	init --yes	empty-project	0.4386s	0.0012s	0.00x	356.40x faster	{'python': [0], 'go': [0]}
targets json	targets --json	installed-project	0.4221s	0.0013s	0.00x	313.18x faster	{'python': [0], 'go': [0]}
script list	list	installed-project	0.4254s	0.0013s	0.00x	334.68x faster	{'python': [0], 'go': [0]}
deps list	deps list	installed-project	0.4332s	0.0013s	0.00x	341.16x faster	{'python': [0], 'go': [0]}
deps tree	deps tree	installed-project	0.4312s	0.0013s	0.00x	340.09x faster	{'python': [0], 'go': [0]}
install local package	install --no-policy ./packages/local-tools	local-install-project	0.4696s	0.0015s	0.00x	303.39x faster	{'python': [0], 'go': [0]}
compile copilot target	compile --target copilot	compilation-project	0.4581s	0.0013s	0.00x	345.01x faster	{'python': [0], 'go': [0]}
pack output	pack --output dist	installed-project	0.4482s	0.0014s	0.00x	329.66x faster	{'python': [0], 'go': [0]}
run script	run stamp	runnable-project	0.4337s	0.0021s	0.00x	210.86x faster	{'python': [0], 'go': [0]}
audit hidden unicode	audit --ci	audit-finding-project	0.4430s	0.0015s	0.00x	294.67x faster	{'python': [1], 'go': [1]}

Workloads

• init scaffold: Creates a new apm.yml in an otherwise empty project directory.
• targets json: Reads configured project targets from apm.yml and emits machine output.
• script list: Reads apm.yml scripts and renders the runnable script inventory.
• deps list: Scans apm_modules package directories and apm.lock.yaml metadata.
• deps tree: Builds a dependency tree from apm.lock.yaml and installed package metadata.
• install local package: Installs a local package and materializes lock/module state.
• compile copilot target: Discovers local primitives and writes the Copilot target artifact.
• pack output: Resolves local package contents and writes a distributable artifact.
• run script: Executes a project script and writes the script's side-effect file.
• audit hidden unicode: Scans a real installed file and fails on planted hidden Unicode.