[Classification] Implement environment, network, workflow-configuration, and unknown rule families

[Dyu20705]

Problem statement

Infrastructure, permissions, workflow configuration, and unsupported evidence must be separated conservatively from application-code failures. The engine needs explicit unknown behavior when evidence is weak, contradictory, or outside the support boundary.

Categories

• environment_permissions
• network_rate_limit
• workflow_configuration
• unknown

Checklist

• Define stable rule ids, versions, descriptions, and priority metadata
• Implement missing environment variable, permission, secret/configuration, disk/resource, and runner setup signatures
• Implement network, registry, DNS, timeout, transient service, and API rate-limit signatures
• Implement malformed workflow, invalid expression/matrix, missing workflow input, invalid action configuration, and unsupported action/runtime signatures
• Distinguish workflow configuration from dependency and application-code failures
• Implement unknown for unsupported, insufficient, contradictory, and no-evidence cases
• Keep temporal assessment separate; do not confirm flaky behavior from one failure
• Require evidence references and documented rule-strength inputs
• Add safe recommended actions that do not expose secret values
• Add positive, negative, ambiguous, multi-signal, and adversarial fixtures

Acceptance criteria

• Environment/network/workflow failures are not mislabeled as test failures when stronger evidence exists
• Workflow-configuration rules cover the category defined in docs/cli-contract.md
• Weak or conflicting evidence returns unknown/abstention through [Decision Policy] Implement rule priority, score semantics, conflict handling, and abstention #24
• Missing-secret reports identify the missing capability/name only when safe and never reveal values
• A single failed attempt cannot produce maintainer_confirmed_flaky
• Rule output is deterministic and never claims calibrated probability
• Output includes rule identity, version, score type, and evidence references
• Output conforms to [Core] Implement versioned input, evidence, and output schemas #34

Dependencies

• Parent epic: [Epic] Deterministic Failure Decision Engine #17
• Fixtures: [Fixtures] Build sanitized, provenance-tracked offline regression corpus #9
• Evidence parser: [Log Parsing] Extract bounded, reproducible failure windows and command context #11 and [Log Parsing] Parse annotations and filter noise without losing causal evidence #12
• Schemas: [Core] Implement versioned input, evidence, and output schemas #34
• Security: [Security] Implement pre-persistence secret redaction and redaction reporting #33
• Decision policy: [Decision Policy] Implement rule priority, score semantics, conflict handling, and abstention #24