ci(agent-image): eval-only pre-merge check for the compass-agent image

[seal-agent]

agent-image/ is deliberately not a moon project, so the CI gate never
builds it — the image has zero pre-merge coverage, and an eval-time
break (a bun-pin drift against the toolchain.nix assert) surfaces only
post-merge in the publish workflow while a consumer waits on a tag. This
adds the cheap tripwire that pulls that eval-time class to PR time.

Closes SEA-1749.

How

The check forces the image derivation's .drvPath:

devenv eval containers.agent.derivation.drvPath

This evaluates the derivation — the .prototools read and the bun-drift
assert (agent-image/toolchain.nix:50-56) — and instantiates the .drv,
but realises none of the heavy closure. So it catches an eval-time break
(a bun-pin drift) in seconds and deliberately does not catch a
realise-time break (an entrypoint.nix FOD-hash invalidation), which only
the post-merge publish build exercises. That realise-time class stays
owned by the publish workflow's main-branch failure notification,
unchanged. This is the accepted tradeoff the frozen record names: a cheap
pre-merge tripwire, not a full image build on the hot path.

Placement

A separate PR-triggered workflow, contents:read only (an eval needs no
registry credentials), path-filtered to the image's evaluation inputs:

• Not a step in ci.yml — folding a non-moon build into the gate's YAML is
  the exact second-source-of-truth staleness the ONE-JOB doctrine forbids.
• Not a step in publish-agent-image.yml — that workflow deliberately
  carries no PR trigger, to keep every token/secret off fork PRs. This
  check needs a PR trigger and no credentials, so it gets its own
  least-privilege workflow.

Its paths filter is the deliberate inverse of the publish workflow's on
one glob: it includes .prototools (which publish excludes), because a
bun-pin move there can only fail the toolchain.nix assert, never silently
change the output — and failing that assert at PR time is precisely this
check's purpose.

The durable operational shape is folded into
docs/architecture/build-and-ci.md beside the publish section.

Verification

End-to-end, at the exact CI-faithful command (clean env, no direnv/proto,
as on a GitHub-hosted runner):

• Clean .prototools -> exit 0, emits the .drv path.
• Drifted .prototools (bun pinned to a bogus version) -> exit 1, with the
  toolchain.nix "has drifted from the .prototools pin" assert message.

Workflow validated with actionlint (0 findings); docs pass
root:markdownlint (0 errors). moon ci green at the pushed head via the
jj-hp gate.

Open Questions

• [Design fork — parked for Matt, overnight] Placement + required-vs-
  advisory. Implemented as a separate PR-triggered least-privilege
  workflow, advisory (not a required check) — the stated assumption. It
  matches the frozen record's own "separate workflow" reasoning for the
  publish lane, and a nix-eval flake should never red a required merge
  gate. The frozen record specifies the what (eval-only, nix eval, no
  realise) but not the placement, so this is a genuine fork. If required
  (branch-protection config) or a different placement is preferred, say
  so and I'll adjust — not blocking, the check is correct and green either
  way.

Co-authored-by: Matt Wilkinson matt@sealedsecurity.com

[linear-code]

SEA-1749