[Clean-code task] Make the exact quality gate reproducible in CI and handoffs

[Flow-Fly]

Parent and mandate

Parent delivery slice: #604. Parent capability: #602. This bounded task implements the approved second slice under the Director’s interpretation of the owner’s “Allons-y” conversation mandate. It grants no merge permission. The complete #604 contract and non-goals govern this task.

Outcome and acceptance

Outcome: local agents, CI, downloaded-artifact review, and the finalizer use the same command and identity contract.

Acceptance:

• Document the command contract, five profiles, exact limitations, artifact layout, retention/regeneration path, advisory dispositions, and failure recovery in docs/agents/quality-verification.md.
• Update the root agent and workflow verification lists so the exact-base quality command is required and its relationship to focused tests, typecheck, lint, build, container smoke, and git diff --check is unambiguous.
• Update .agentic-loop.yml to name the public exact-base quality gate. Preserve project roles and models, multi-task slices, fresh finalization after FIXED, the two-pass maximum, and human merge approval.
• Update only the quality-command references in .codex/agents/workflow-director.toml, .codex/agents/delivery-worker.toml, and .codex/agents/pr-finalizer.toml. Do not change their names, models, reasoning effort, tier, responsibilities, or finalizer verdict rules.
• In CI, check out the actual PR head in both existing jobs and pass the exact event base/head. Replace the five existing unit/browser test invocations and Fallow action with one quality:verify execution rather than running those suites twice. Keep shared typecheck and Node ESM smoke, server typecheck/lint, Worker typecheck/dry-run, root typecheck/lint, build, and server-container smoke as explicit executed responsibilities. The canonical quality command may invoke the Node smoke once where that avoids a second shared test wrapper.
• Upload only .fallow/quality with hidden files enabled, failure logs under if: always(), missing artifacts treated as an error, a candidate 14-day retention, and action SHA 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a. The artifact name includes the exact source head.
• Prove quality:check accepts the downloaded/relocated positive fixture only with its recorded original root and rejects a mixed or stale bundle.

Primary write ownership:

• docs/agents/quality-verification.md
• docs/agents/handoffs.md and the workflow entry in docs/agents/change-map.md, limited to exact quality-command/evidence pointers
• specs/research/clean-code-quality-evidence.md, importing the verified research note and correcting its source-state wording
• AGENTS.md
• docs/operations/codex-agent-workflow.md
• .agentic-loop.yml
• .github/workflows/ci.yml
• .codex/agents/workflow-director.toml
• .codex/agents/delivery-worker.toml
• .codex/agents/pr-finalizer.toml
• package.json only for final command wiring
• existing test/configuration files already named by TASK-A/B when integration exposes a verified mismatch

docs/ is ignored by default except docs/agents/**; use the named tracked documentation path rather than adding a broad ignore exception. .fallow/** is already ignored and remains generated evidence, not source.

Verification and review

Use the exact starting develop revision and public quality commands frozen in #604. Keep all three sibling tasks executable together; their order is collection, constraints, then CI and handoffs. The complete draft PR receives fresh Standards and Spec review under docs/agents/handoffs.md. No product code, dependency/lockfile changes, score cleanup, or merge is authorized.

[Flow-Fly]

Delivered in PR #616 at develop commit ea1352ab7387aed9c052d5a7e8e47ed102ee4068. CI uses exact head/base identities, retains complete or failed evidence with bounded retention, and preserves the required noncoverage checks. The actual downloaded integration bundle is accepted from its exact clean checkout.

Accepted integration evidence: develop CI34465718704 passes and the actual downloaded bundle is accepted at the merge revision. No unresolved confirmed blocker remains.