test(agentic-engineering): port the surveyor contract guards upstream #95

🤖 Generated by the Agentic Engineer

Evidence

The consuming monorepo pins its local portfolio-surveyor overlay with 31 guards in
.claude/scripts/portfolio-surveyor.test.sh, which assert directly against
.claude/agents/portfolio-surveyor.md. #94 upstreams the role content, but not those guards.

Problem

Once the consumer deletes its overlay (the point of #78), those 31 guards lose their target. Deleting
the overlay without porting them first trades a token saving for a loss of drift enforcement on
the exact refinements #94 just upstreamed — the generic role would carry the rules with nothing
pinning them.

The guards encode the generic role contract (head-match-before-recency, abbreviated-sha prefix
matching, the check-run/login split, newest-review-only counting, fail-closed truncation), so they
belong beside the agent they pin, not in one consumer.

Acceptance criteria

• The generic guards run in this repo's lint-scripts CI job against
  plugins/agentic-engineering/agents/portfolio-surveyor.agent.md.
• Each ported guard is RED-proven: it fails when the invariant is removed from the role file.
• Guards that are genuinely deployment-specific stay in the consumer, and the split is recorded.
• Consumer can then delete its overlay and its now-duplicated guards without losing coverage.

Size

M. Blocks the consumer's delete-local-surveyor slice (monorepo#2363); follows #94.