Add StewardCheck: task-scoped change receipts for coding workflows

[Afloat16]

Summary

Add StewardCheck 0.1.0, an independent, installable Python package under tools/stewardcheck. It complements existing coding assistants with an actual task-start working-tree baseline, explicit change scope, bounded context packets, and receipts tied to the checked workspace.

• Provider-neutral CLI: start, packet, check, report, and doctor.
• Non-destructive inspection; declared checks run only with check --run.
• Scope/protected-path/file-budget rules, credential-pattern and test-weakening review hints, partial-staging warnings, and stale-result detection.
• English primary README and complete Simplified Chinese guide.
• Package-scoped MIT license, third-party attribution, upstream design survey, threat model, contribution guide, and validation record.
• Regression tests, temporary-repository demo, and six-job Linux/macOS/Windows CI configuration.

Validation performed locally

Linux, CPython 3.13.5, Git 2.47.3:

• 91 unit/integration tests passed.
• Coverage.py reported 93% combined statement/branch coverage.
• Built wheel, installed it into a clean virtual environment without runtime dependencies, and reran all 91 tests successfully.
• Real subprocess demo verified a passing fix, stale receipt, and an out-of-scope blocker that prevents check execution.
• Uploaded package and workflow Git tree hashes match the tested local files. All pre-existing repository files are unchanged.

CI outcomes should be read from this pull request's actual runs; the local results above do not claim cross-platform success.

Boundaries

This is an alpha working-tree review tool, not a sandbox, automatic coding agent, rollback system, or semantic/security proof. Human acceptance criteria remain unchecked. Ignored untracked files and opaque repository interiors are outside comprehensive coverage. Check programs inherit the current user's permissions. No upstream implementation or credential rule catalog is vendored.

Installation after merge

pipx install "git+https://github.com/Afloat16/ai-dev-steward.git#subdirectory=tools/stewardcheck"

The package is self-contained and does not change the parent skill's behavior or license.

[Afloat16]

CI verification

All six jobs in workflow run 36683767766 completed successfully for head 573d58d56d9b9d31bdb44d3608a4ab81f3b2690c:

• Ubuntu: Python 3.11, 3.12, 3.13, and 3.14.
• macOS: Python 3.13.
• Windows: Python 3.13.

Each job completed package installation, unit/integration tests, module and console entrypoint checks, and the isolated end-to-end demo. The Windows log records 91 discovered tests with 8 expected POSIX-specific skips (OK (skipped=8)). These results supplement, rather than replace, the local 91-test / 93%-coverage validation record.

The distributable source archive was independently extracted and its demo rerun successfully. All relative Markdown links were checked, and wheel source bytes were compared with the uploaded package manifest.