feat(copilot): gate this repository on its own integrity check

[imran-siddique]

Closes #74. Stacked on #117, so the diff here is only the gate. Base retargets to main once #117 merges.

We ship a pull-request gate for other people's repositories and did not run it on our own. copilot-tests.yml called verify, but with no baseline committed that exits 0 saying "No approved baseline", so nothing was enforced.

What changes

• .agentrust/copilot-baseline.json committed, via python copilot/engine/capture.py approve.
• .github/workflows/copilot-integrity.yml, running the local ./copilot action with fail-on-drift: true.
• The duplicate verify step drops out of copilot-tests.yml.

The baseline is empty, and that is the point

This repository has none of the surfaces the check looks for: no .github/copilot-instructions.md, no .github/instructions/, no AGENTS.md, no skill roots, no MCP config. So the first thing this gate can fire on is someone adding one. That is exactly the event worth catching, because it is the moment this repository starts telling a coding agent how to behave.

Three decisions worth reviewing

Enforcing rather than advisory. #74 offered fail-on-drift: false as a starting point for a baseline that needs settling. An empty baseline has nothing to settle, and a report-only gate is the same non-enforcement posture the issue was filed about.

No path filter. copilot-tests.yml is scoped to copilot/**, which is right for tests and wrong for this. AGENTS.md resolves to the nearest one, so a file added three directories down changes what Copilot reads in that subtree. A path filter would mean the gate is absent exactly when it matters, so this runs on every pull request.

No comment on fork pull requests. GITHUB_TOKEN is read-only for those, so the comment step would 403 and fail a contribution that did nothing wrong. The check itself still runs and still blocks; only the comment is skipped. The step summary carries the same content either way.

Verified locally

$ python copilot/engine/capture.py verify
### Copilot agent composition unchanged
exit=0

$ echo "be nice" > AGENTS.md && python copilot/engine/capture.py verify
### This pull request changes what Copilot reads
| added | instruction file | `AGENTS.md` |
exit=1

[github-actions]

Copilot agent composition unchanged

Nothing added, nothing subtracted in the instructions, skills and MCP configuration this repository gives Copilot.