ci: consolidate trivial gates into hygiene.yml

.github/workflows/clean-root.yml → .github/workflows/hygiene.yml

@@ -1,19 +1,33 @@
-name: Clean Working Tree
+name: Hygiene
+
+# Consolidates the trivial, no-toolchain repo gates into one workflow with a
+# single checkout, so a push doesn't queue two separate near-instant jobs for
+# two separate runners. Neither job here is a required branch-protection
+# check for nsentry (only "Lint + Typecheck + Test (client + mobile)" and
+# "gitleaks" are) — see ~/Sites/nself/.claude memory on CI wall-clock work.
+#
+# Trigger scope is the union of the two former workflows (clean-root ran on
+# [main, develop], generated-file-gate on [main] only) — broader, never
+# narrower, so nothing that used to run stops running.
+
 on:
   push:
     branches: [main, develop]
   pull_request:
     branches: [main, develop]
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: hygiene-${{ github.ref }}
   cancel-in-progress: true
+
 jobs:
-  clean-root:
-    name: clean-root
+  hygiene:
+    name: hygiene
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Forbid markdown at repo root other than README.md
         run: |
@@ -87,3 +101,45 @@ jobs:
             echo "::warning::.gitignore missing baseline patterns: ${MISSING[*]}"
             echo "See ~/.claude/CLAUDE.md (Clean Working Tree - Hard Rule) for full baseline."
           fi
+
+      - name: Scan diff for GENERATED BY markers
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            git fetch origin main --depth=1
+            BASE="origin/main"
+          else
+            BASE="${{ github.event.before }}"
+            if [ -z "$BASE" ] || ! git cat-file -e "$BASE" 2>/dev/null; then
+              BASE="HEAD~1"
+            fi
+          fi
+
+          CHANGED=$(git diff --name-only "$BASE"...HEAD || true)
+          if [ -z "$CHANGED" ]; then
+            echo "No changed files to scan."
+            exit 0
+          fi
+
+          FAIL=0
+          while IFS= read -r f; do
+            [ -f "$f" ] || continue
+            if head -n 5 "$f" | grep -q "# GENERATED BY"; then
+              if git check-ignore -q "$f"; then
+                echo "OK: $f is generated but gitignored."
+              else
+                echo "ERROR: Refusing to commit generated file. Add to .gitignore first."
+                echo "  -> $f"
+                FAIL=1
+              fi
+            fi
+          done <<< "$CHANGED"
+
+          if [ "$FAIL" -eq 1 ]; then
+            echo "ERROR: Refusing to commit generated file. Add to .gitignore first."
+            exit 1
+          fi
+
+          echo "Generated File Gate: clean."