Roll out EgoLint through manual, observe, ratchet, and enforce waves

[szmyty]

Outcome

Adopt the pinned EgoLint distribution across the repository fleet without interrupting current rapid development or hiding existing quality debt.

Rollout sequence

1. Inventory repository languages, manifests, current lint workflows, overrides, generated paths, and applicability blockers.
2. Run manual complete audits and retain evidence.
3. Generate reviewable deterministic fix patches; never write directly to consumer repositories.
4. Classify remaining findings as defects, rule defects, unavailable evidence, or explicitly owned temporary debt.
5. Enable non-blocking observe runs after merges.
6. Promote cleaned repositories to ratchet so new debt blocks.
7. Promote mature/open-contribution repositories to enforce with required pull-request checks.

Scope

• Consume the reusable Relay workflow rather than copying GitHub Actions implementations.
• Use the repository's minimal egolint.toml and preserve legitimate native project configuration.
• Pin EgoLint release/image/workflow versions and digests.
• Produce preview, diff, conflict, apply, verification, and rollback evidence per repository.
• Never manufacture a green status, remove a linter arbitrarily, or blanket-suppress findings.
• Respect archived, private, external, publication, site, library, CLI, and application differences.
• Surface fleet-safe adoption state to Observatory without exposing private repository details.

Acceptance criteria

• Every eligible repository has a classified current state and proposed mode.
• Manual audits precede automatic blocking.
• Existing findings remain visible and owned throughout migration.
• No repository enters enforce before a clean or approved ratcheted baseline exists.
• Thin Relay consumption replaces copied workflow logic.
• At least one small tool, one polyglot/application repository, and one highly customized repository prove the rollout.
• Rollback restores the prior workflow/configuration/evidence set atomically.

Dependencies

• Run pinned EgoLint profiles through a reusable workflow relay#49
• Release Egolint with security and dependency-debt profiles egolint#5
• Implement manual, observe, ratchet, and enforce modes egolint#36