test(action): dogfood CERTIFICATION_FAILED end-to-end

[BenSheridanEdwards]

Why does this feature exist?

The action-dogfood workflow drives the composite Action against a fixture per trust state and asserts the verdict — it's the end-to-end safety net for the trust contract. It covered six of the eight states. The two gaps were CERTIFICATION_FAILED and REPORT_PUBLICATION_FAILED, and that first gap is not academic: 4.6.2's content-geometry regression wrongly routed ordinary copy-editing PRs into CERTIFICATION_FAILED (an unclearable state), and it shipped undetected precisely because nothing ever drove the Action into that state here. This closes it.

What changed?

• scripts/action-dogfood-fixtures.mjs: a new certfail-base / certfail-head pair — identical maps, but a styleproof-coverage.json declaring determinism: 'unproven' (a side that was neither self-checked nor replayed). assessDeterminism turns that into status: 'unproven' (verified locally: styleproof-diff --json reports determinism.status: "unproven").
• .github/workflows/action-dogfood.yml: a certfail step runs the Action against that pair and asserts it fails (outcome == 'failure') with trust-state == 'CERTIFICATION_FAILED' — proving unproven provenance certifies nothing and the approval box cannot clear it, with maps identical so provenance is the only thing under test.
• test/action.test.mjs: the workflow-contract test now expects 8 Action invocations and pins the new certfail assertions.
• REPORT_PUBLICATION_FAILED is left unit-tested (the trust step's publish/delivery failure domains are already pinned in action.test.mjs) but not end-to-end dogfooded: forcing a real publish failure needs a broken remote/permissions, which a self-contained dogfood can't stage cleanly. Called out in the commit as a follow-up rather than faked.

Behavioural Proof (with video and screenshots)

Not applicable — CI/Action trust-contract coverage with no rendered surface. The proof is executable: locally, node scripts/action-dogfood-fixtures.mjs && node bin/styleproof-diff.mjs action-dogfood/certfail-base action-dogfood/certfail-head --json reports determinism.status: "unproven"; the new dogfood step asserts the Action escalates that to a failing CERTIFICATION_FAILED; and this PR's own action-dogfood CI job exercises it.

Verification Summary

• Full unit suite: npm test — 608/608 pass (updated the workflow-contract count 7 → 8 and added the certfail pins).
• Local fixture proof: the certfail pair produces determinism.status: "unproven" through the real styleproof-diff.
• Pre-commit gate green: tsc + typecheck, eslint, prettier, gitleaks, fallow, commitlint.
• This PR's action-dogfood job is the live end-to-end proof (7 states now, was 6).

🤖 Generated with Claude Code

[github-actions]

🗺️ StyleProof report

📊 View the side-by-side visual report →

---

Coverage, determinism, or report/diff consistency evidence is incomplete — repair the capture or reflow source; visual approval cannot clear this failure.