[Agent] Contract Validator GitHub Action — first live governed agent on this repo

[Skull-boy]

What this is

Right now, when someone opens a PR adding a contract.yaml,
nothing validates it automatically. A maintainer has to manually
check it or remember to run scyvera.validate_contract() locally.

This issue is to fix that — by building the first governed agent
that runs directly on this repo.

What it does

A GitHub Actions workflow that:

1. Triggers on every PR that adds or modifies a .yaml file
2. Runs scyvera.validate_contract() on every changed .yaml in the diff
3. Posts a structured comment on the PR with the result:
4. Fails the check (but does NOT block merge) if violations are found
   — the maintainer decides whether to merge anyway

Why this matters

This is the repo eating its own cooking. Every contributor who opens
a PR will see governance in action before they've read a single doc.
The validator's own contract.yaml will be in the repo at
.github/agents/contract-validator/contract.yaml — reviewable,
forkable, and governed by the same spec it enforces.

What the deliverable is

Three files:

1. .github/workflows/validate-contracts.yml
The GitHub Actions workflow. Triggers on pull_request,
finds changed .yaml files, runs validation, posts comment.

2. .github/agents/contract-validator/contract.yaml
The agent's own contract. Write this first before touching
any workflow code. It should declare:

• permissions: read-only (PR files, post comment)
• side_effects: posts GitHub comment only
• approval_points: none — read-only agents don't need human approval
• lifecycle: triggered (not persistent)

3. .github/agents/contract-validator/README.md
One page: what the agent does, what its contract enforces,
how to run it locally.

Constraints

• Must use scyvera.validate_contract() — do not write
  a custom validator
• The comment must reference the agent's own contract.yaml
  path so it's auditable
• Do NOT block merges — post the result, let the maintainer decide
• The action must work on fork PRs (use
  pull_request_target carefully if needed)

How to get started

1. Fork the repo
2. Write .github/agents/contract-validator/contract.yaml first
3. Build the workflow around it
4. Test against PR feat(n8n): add Ollama embeddings to duplicate detector #28 or docs: add contract.yaml cheatsheet reference and monitor-alert-escalate pattern (#29, #30) #31 as example inputs —
   both have contract.yaml changes
5. Open a PR

Drop a comment here before starting so we don't duplicate effort.