ci(env): move the CLIENT_ENV vocabulary guard into the job that gates (backend#1729)

[LukasWodka]

Summary

The vocabulary-agreement guard from #706 ran in helm-ci.yaml → job Helm lint. That job is not a required status check on this repo. The required contexts on develop are:

Unit tests · Lint · quality/gitleaks · quality/house-rules · quality/shellcheck
quality/action-pins · version-bump-gate/version-check · Source-of-truth drift

So a PR that made the four CLIENT_ENV declarations disagree was mergeable with the guard red. It advised; it did not gate.

That is backend#1729's own class, in backend#1729's own flagship deliverable — a mechanism that looks like verification but isn't connected to the outcome it claims to control.

What changed

Move the step into drift-checks.yaml → Source-of-truth drift, which needed no new configuration to make this real:

• required on develop and on main — a disagreement now blocks the merge
• no paths: on pull_request, deliberately (its header records why: a path-filtered required check bricks PRs outside those paths — docs(claude): sync org-standards block (backend#1602) #651/chore(devex): install a make check pre-push hook via make setup (backend#1606) #657/docs(#1528): document the MySQL DB identity model + edgeuser retirement (D10) #660 on 2026-08-11). So the guard now also runs on the installer-only PRs helm-ci's filter skipped entirely
• already the home of the sibling duplicated-declaration guard (check-drift.sh)
• needs only bash + python3, ~2s

helm-ci loses the step and the two paths: entries that arrived with it in #706:

entry	why
scripts/install-k8s.ps1	genuinely leaves — helm-ci is the heaviest workflow here (real k3d cluster + two 4-platform matrices); a PowerShell installer edit has no other reason to start it
scripts/lib/common.sh	also goes, but was always redundant — the pre-existing scripts/lib/** glob still matches it, so triggering is unchanged

No branch-protection change is required or included. The gate comes from landing in an already-required job.

Test plan

Mutation-proved rather than assumed:

mutation applied  (staging) → stagingXX) in scripts/lib/common.sh)
guard exit after mutation = 1
guard exit after restore  = 0

The mutation anchor was asserted to have applied before trusting the result — an inert mutation and good coverage look identical in a log.

Armed while green. On this branch all four declarations agree and every accepted spelling is exercised: dev 12, development 2, prod 11, production 4, staging 9, stg 6.

Both workflow files re-parse as valid YAML; Source-of-truth drift now lists check-drift + CLIENT_ENV vocabulary agreement.

Checklist

• Targets develop
• No new required-check contexts added (uses an existing one)
• Guard verified green before arming
• Guard verified able to go red

Refs backend#1729

---

Note

Low Risk
CI workflow wiring only; no application or chart runtime behavior changes. Effect is stronger enforcement of an existing guard via an already-required check.

Overview
Moves the CLIENT_ENV vocabulary agreement step (env-vocabulary-agreement.sh) from helm-ci’s Helm lint job into drift-checks’s Source-of-truth drift job so a mismatch across the four declarations (Go template, JSON Schema, bash, PowerShell) blocks merge instead of only failing a non-required check.

drift-checks gains the new step and header comments that position it as the home for duplicated-declaration guards and note CLIENT_ENV alongside existing drift checks. helm-ci drops that step and removes paths: entries for scripts/tests/env-vocabulary-agreement.sh, scripts/install-k8s.ps1, and the explicit scripts/lib/common.sh line (installer-only edits no longer trigger the heavy workflow; scripts/lib/** still covers common.sh).

^{Reviewed by Cursor Bugbot for commit bfa967d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit bfa967d. Configure here.}