Add single supervisory conformance controller for non-Go artifacts

.github/workflows/conformance.yml

@@ -0,0 +1,44 @@
+name: Conformance
+
+# The single supervisory conformance controller. Unlike the per-lab workflows,
+# this has no path filter: it runs on every change so that malformed non-Go
+# artifacts (merge-conflict markers, broken shell hooks, invalid JSON configs)
+# are caught no matter which part of the tree they land in — the gate Go's
+# compiler already gives Go source.
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: conformance-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  conformance:
+    name: Repository conformance
+    runs-on: ubuntu-latest
+    env:
+      GOWORK: "off"
+    defaults:
+      run:
+        working-directory: conformance
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: conformance/go.mod
+          cache-dependency-path: conformance/go.mod
+      - name: Show toolchain
+        run: |
+          go version
+          bash --version | head -1
+          pwsh --version || echo "pwsh unavailable"
+      - name: Run conformance controller
+        run: go run ./cmd/conformance
+      - name: Test conformance controller
+        run: go test ./...

conformance/cmd/conformance/main.go

@@ -0,0 +1,26 @@
+// Command conformance runs the repository's single supervisory conformance
+// controller and exits non-zero if any tracked non-Go artifact is malformed.
+//
+// Usage:
+//
+//	go run ./cmd/conformance
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/operatorstack/intelligence-flow/conformance"
+)
+
+func main() {
+	result, err := conformance.Run()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "conformance: %v\n", err)
+		os.Exit(2)
+	}
+	fmt.Print(result.Report())
+	if len(result.Violations) > 0 {
+		os.Exit(1)
+	}
+}