feat(verify-release): wire quality-rails evaluator stage into canonical verification (#1275)

- new canonical-only quality-rails stage (after build) invokes the evaluator
  CLI on the repo root — QC-19 monorepo subject — instead of duplicating
  presence logic; no ci.yml mirror (same shape as the build stage)
- parity spec updated: stage-name list, evaluator-delegation assertions, and
  negative controls for inline duplication / dropped command
- quality-rails README points at the probe inventory (input doc)

scripts/verify-release.test.mjs

@@ -4,7 +4,7 @@ import { createRequire } from 'node:module';
 import path from 'node:path';
 import test from 'node:test';
 
-import { STAGES } from './verify-release.mjs';
+import { STAGES, stageByName } from './verify-release.mjs';
 
 // SDLC-D-034 checkout invariant: publication in .woodpecker/publish.yml is
 // bound to exact-commit terminal verification. This suite parses the real
@@ -229,10 +229,21 @@ steps:
 function assertStagesMirrorCi(stages, ci) {
   const canonical = Object.fromEntries(stages.map((stage) => [stage.name, stage.commands]));
 
-  // The complete mandatory set, in gate order.
+  // The complete mandatory set, in gate order. `quality-rails` is a
+  // canonical-only stage (RI-N4, QC-19): like `build`, it has no ci.yml
+  // mirror to match — its contract is asserted separately below.
   assert.deepEqual(
     stages.map((stage) => stage.name),
-    ['sanitization', 'upgrade-guard', 'typecheck', 'lint', 'format', 'test', 'build'],
+    [
+      'sanitization',
+      'upgrade-guard',
+      'typecheck',
+      'lint',
+      'format',
+      'test',
+      'build',
+      'quality-rails',
+    ],
   );
 
   // Guard stages: ci.yml commands minus its `apk add` environment prep must be
@@ -301,3 +312,38 @@ test('the root package.json exposes verify:release as the canonical command', as
   const packageJson = JSON.parse(await readFile(path.join(process.cwd(), 'package.json'), 'utf8'));
   assert.match(packageJson.scripts['verify:release'], /scripts\/verify-release\.mjs/);
 });
+
+// RI-N4 (card RI-3-002): the `quality-rails` stage must route through the TS
+// evaluator instead of duplicating its presence logic inline. The evaluator
+// owns QC-19; this file keeps that delegation honest.
+function assertEvaluatorStage(stage) {
+  assert.ok(stage, 'canonical stages must include a quality-rails stage');
+  assert.ok(Array.isArray(stage.commands) && stage.commands.length > 0);
+  for (const command of stage.commands) {
+    assert.match(
+      command,
+      /packages\/quality-rails\/dist\/cli\.js.*quality-rails evaluate/,
+      `quality-rails stage command must invoke the evaluator CLI, got: '${command}'`,
+    );
+  }
+}
+
+test('the quality-rails stage invokes the evaluator rather than duplicating its logic', () => {
+  assertEvaluatorStage(stageByName('quality-rails'));
+});
+
+test('a quality-rails stage that re-implements presence logic inline fails the checker', () => {
+  // Negative control: replacing the evaluator invocation with an inline
+  // `test -f` presence loop is exactly the duplication RI-N4 forbids — the
+  // checker must go red on it.
+  const duplicated = {
+    name: 'quality-rails',
+    commands: ['test -f .husky/pre-commit && test -f .husky/pre-push'],
+  };
+  assert.throws(() => assertEvaluatorStage(duplicated), /must invoke the evaluator CLI/);
+});
+
+test('a quality-rails stage that silently drops the evaluator command fails the checker', () => {
+  const empty = { name: 'quality-rails', commands: [] };
+  assert.throws(() => assertEvaluatorStage(empty), /commands/);
+});