feat(#831): pre-validate shim content before creating PRs

[fullsend-ai-coder]

Summary

Add pre-validation of rendered shim content against the TestShimLabeledEventFiltering alignment test contract in reconcile-repos.sh. This prevents the reconciliation bot from opening PRs that would fail CI — as happened in PR fullsend-ai#5772 where the config repo template lacked the ready- prefix guard and label-aware concurrency group.

Related Issue

Fixes #831

Changes

• Add validate_shim_content() function to reconcile-repos.sh that decodes base64 shim content and checks for three required patterns: the github.event.action != 'labeled' guard, the startsWith(github.event.label.name, 'ready-') prefix filter, and the format('label-{0}' concurrency group structure
• Add pre-loop validation that runs the check once on the base template before processing any repos, exiting with non-zero on failure (fail-fast)
• Add per-repo validation in the stale-shim update path that validates header-merged content, skipping repos whose merged content would fail CI
• Update the default test template to include the required alignment patterns
• Add four new test cases covering broken template (missing ready- prefix), broken template (missing concurrency group), valid template proceeding to enrollment, and stale shim path validating header-merged content

Testing

• All 10 script tests pass (bash internal/scaffold/fullsend-repo/scripts/reconcile-repos-test.sh)
• Tests added for new validation logic (tests 5-8)
• Secret scan passed

Checklist

• PR title follows Conventional Commits (correct type, ! for breaking changes)
• Commits are signed off (DCO) — human and human-directed agent sessions only

---

Closes #831

Post-script verification

• Branch is not main/master (agent/831-shim-pre-validation)
• Secret scan passed (gitleaks — c887fc47c59d8b87b5282ca44044d2933d30df41..HEAD)
• PR body secret scan passed (gitleaks — no-git)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:43 AM UTC · Completed 9:55 AM UTC
Commit: be3f8e8 · View workflow run →

[fullsend-ai-review]

Looks good to me

[guyoron1]

/fs-fix

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 10:31 AM UTC · Completed 10:36 AM UTC
Commit: be3f8e8 · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 1 (human-triggered)

No changes made. The PR was approved by the review bot with no findings, and the human /fs-fix trigger included no specific instruction. All tests pass and code is clean.

Disagreed (1):

1. No actionable feedback to address: The review bot approved this PR with 'Looks good to me' and no findings. The human triggered /fs-fix without a specific instruction (instruction was 'none'). All 10 tests pass, the code follows repo shell scripting conventions, and the secret scan is clean. No changes are needed.

Tests: passed

Next steps:

• /fs-review — request a re-review of the changes
• /fs-fix <your instruction> — run another fix pass with specific guidance
• Push commits directly — review re-runs automatically on push
  _{Updated by fullsend fix agent}

[github-actions]

This pull request has been automatically marked as stale because it has not had any activity in the last month. It will be closed in 2 weeks if no further activity occurs. Remove the stale label to reset the inactivity timer.