feat(taskless): enforce the workspace CLI in CI instead of asking for it

The check step added in the previous commit carried a comment asking a
reader not to "fix" `pnpm cli check` back to `npx @taskless/cli check`. A
request is not a boundary, and this repository lints its own prose precisely
because comments do not hold. So the invariant becomes a rule.

`ci-uses-workspace-cli` fails any `.github/workflows/*.yml` step whose `run:`
invokes a published `@taskless/cli`. The repository IS the CLI: checking its
rules with a published build would let a commit that breaks rule evaluation
pass its own CI and surface a release later, in someone else's project.

Three things the matcher has to get right, each measured rather than assumed:

`npx @taskless/cli` already appears in PROSE in `validate.yml` and
`release-cli-nightly.yml`, explaining this same decision. A rule that flagged
its own rationale would be worse than no rule, so the matcher is anchored to
a `run:` key's value rather than to file text. Verified: the clean tree
reports nothing.

A `run:` value is a `flow_node` inline and a `block_scalar` under `|`, and
both spellings are ordinary here, so both are matched. The first attempt
carried one `regex` with no sibling `kind` and was rejected by this repo's
own `regex-requires-kind` check, which is the dogfooding working.

`@taskless/cli-nightly` is deliberately excluded. The nightly is a published
artifact by design and the release workflows reference it on purpose. The
pattern ends at `($|[@\s])` rather than a negative lookahead, which the Rust
regex engine ast-grep uses does not support.

Proven both ways: with the step reverted to `npx @taskless/cli check`,
`check` exits 1 naming this rule; restored, it exits 0.

Author: theCodeDrift

.github/workflows/validate.yml

@@ -87,15 +87,12 @@ jobs:
       # for anyone used to reading these logs. It only needs to be after
       # `Build`; nothing above it depends on it.
       #
-      # `pnpm cli` is the workspace build (`packages/cli/dist/index.js`), NOT a
-      # published release, and that is a deliberate divergence from `ci.txt`.
-      # The recipe is written for consumers installing the published CLI; here
-      # the repository IS the CLI, so running `npx @taskless/cli check` would
-      # test the published artifact and exempt the engine at HEAD from its own
-      # rules. Do NOT "fix" this back to `npx`: a commit that breaks rule
-      # evaluation has to fail on the commit that breaks it, not one release
-      # later. `Build` above ran `pnpm build` on this same commit, so `dist/`
-      # here can be neither stale nor missing, and an absent `dist/` would fail
+      # `pnpm cli` is the workspace build, NOT a published release. That is a
+      # deliberate divergence from `ci.txt` and is ENFORCED, not requested:
+      # the `ci-uses-workspace-cli` rule fails this very workflow if the
+      # invocation is changed back, and carries the reasoning in its `note:`.
+      # `Build` above ran `pnpm build` on this same commit, so `dist/` here
+      # can be neither stale nor missing, and an absent `dist/` would fail
       # this step loudly rather than pass it empty.
       #
       # This blocks. `check` exits non-zero on any error-severity finding and

.taskless/rules/sg/ci-uses-workspace-cli/.tests/ci-uses-workspace-cli-20260826-test.yml

@@ -0,0 +1,35 @@
+id: ci-uses-workspace-cli
+valid:
+  - |
+    steps:
+      - name: Check house style
+        run: pnpm cli check
+  - |
+    steps:
+      - name: Install
+        run: npx some-other-tool --version
+  - |
+    steps:
+      - name: Nightly smoke test
+        run: npx @taskless/cli-nightly@0.10.2 check
+  - |
+    steps:
+      - name: Multi-line, workspace build
+        run: |
+          pnpm build
+          pnpm cli check
+invalid:
+  - |
+    steps:
+      - name: Check house style
+        run: npx @taskless/cli check
+  - |
+    steps:
+      - name: Check house style
+        run: npx @taskless/cli@latest check
+  - |
+    steps:
+      - name: Multi-line, published release
+        run: |
+          pnpm install
+          npx @taskless/cli check

.taskless/rules/sg/ci-uses-workspace-cli/ci-uses-workspace-cli.yml

@@ -0,0 +1,48 @@
+id: ci-uses-workspace-cli
+language: Yaml
+severity: error
+message: A workflow step must run the workspace CLI (`pnpm cli`), not a published release.
+note: |
+  This repository IS the Taskless CLI, so a workflow that runs `npx
+  @taskless/cli` checks the repository's rules with a PUBLISHED build rather
+  than the one at HEAD. A commit that breaks rule evaluation would then pass
+  its own CI and only fail a release later, in someone else's project.
+
+  `validate.yml` runs `pnpm build` before its check step, so the workspace
+  build is already present and cannot be stale or missing.
+
+  `ci.txt`, the onboarding recipe, tells consumers to use `npx
+  @taskless/cli`. That is correct for a project that merely depends on the
+  CLI, and wrong here. This rule is the difference between the two, enforced
+  rather than written down: the comment it replaces asked a reader not to
+  "fix" the invocation back, which is a request, not a boundary.
+
+  `@taskless/cli-nightly` is deliberately not matched. The nightly IS a
+  published artifact by design, and the release workflows reference it on
+  purpose.
+
+  Only a `run:` value matches, never a comment: `npx @taskless/cli` appears
+  in prose in `validate.yml` and `release-cli-nightly.yml`, explaining this
+  very decision, and a rule that flagged its own rationale would be worse
+  than no rule.
+files:
+  - ".github/workflows/*.yml"
+  - ".github/workflows/*.yaml"
+rule:
+  all:
+    - kind: block_mapping_pair
+    - has:
+        field: key
+        kind: flow_node
+        regex: '^run$'
+    - has:
+        field: value
+        stopBy: end
+        any:
+          # A `run:` value is a flow_node when written inline and a
+          # block_scalar under `|` or `>`. Both spellings are ordinary in
+          # these workflows, so both have to match.
+          - kind: flow_node
+            regex: 'npx\s+@taskless/cli($|[@\s])'
+          - kind: block_scalar
+            regex: 'npx\s+@taskless/cli($|[@\s])'