AGENTS.md and PLAN.md already told every phase to `bash .agents/validate.sh`, but the script
itself was never tracked, so a fresh clone could not run the gate at all.
Four checks: `uv run pytest --cov --cov-fail-under=94`, `uv run ruff check src tests agent`,
`uv run pyright`, and a zero-dependency `node --check` of every served JS. Plus repo hygiene
(tracked files matching .gitignore, log drops/key material, non-placeholder secrets in the
tracked env templates) and an advisory `uv pip list --outdated`.
Two rules are baked in because breaking them made a false green: run the project toolchain
through `uv run` (a bare `python3`/`ruff` on PATH tests an interpreter nobody deploys and an
older linter than the pyproject floor), and treat a missing tool as a failure rather than an
`if command -v` skip.
LLM-Generated: true
