fix(ci): list the files to check on the host, not in the container (#190)

[Gerrrt]

Closes #190.

make validate failed on the monitoring host and passed in CI — the wrong way
round for a script whose header claims "Everything CI runs, runnable locally".

stacks/observability/alertmanager/.rendered/heartbeat_url:
	Wrong line endings or no final newline
...
4 errors found
  FAIL editorconfig-checker

It was not a missing exclude

scripts/lint.sh:111-119 already says those files should be skipped, and says
how — editorconfig-checker lists files with git ls-files, so gitignored trees
are untracked in both a workstation and a CI checkout and both runs see the same
files. The image is even chosen to make that work: it installs git and marks
/check a safe.directory.

The reasoning is right. The mechanism was not running.

Where it broke

In a git worktree, .git is a file holding an absolute path to a gitdir
outside the bind mount:

$ docker run --rm -v "$PWD:/check" -w /check --entrypoint sh <image> -c 'git ls-files'
fatal: not a git repository: (null)

The checker then silently falls back to walking the filesystem and picks up
every gitignored tree it finds — backups/, certificates/, .venv/,
.rendered/. A normal checkout is unaffected, which is why this only ever
showed up in the agent worktrees on this host.

The silent substitution is the real defect: nothing reports that the file set
changed, the check just starts examining something else. Same family as #62 and
#63.

Mounting the real gitdir does not help — the worktree's gitdir holds a
back-pointer to the worktree's own .git path, which inside the container is
/check, and git rejects the mismatch. Tested.

Fix

Build the list on the host, where git resolves a worktree correctly, and pass it
in. The checker now gets the same tracked files whether it runs from the pinned
image or a local binary, and cannot substitute a different set without saying
so.

An empty list fails rather than skips — a skip means the linter was
unreachable; this means it was reachable with no trustworthy answer to what it
should check, which is exactly the state the fallback used to paper over.

Two details the fallback was hiding:

• -z, because a tracked path may contain a space.
• an existence test, because a tracked-but-deleted file made the checker panic
  with a Go stack trace rather than report anything.

Verified on the deploy host, after make up, with the rendered files present

check	result
reproduced first on a clean main	4 errors found / FAIL
make validate after the fix	green end to end
same file set as CI	114 both ways — host git ls-files, and the container's own listing in a normal checkout
still catches real defects	trailing space added to scripts/snmp-verify.sh → 303: Trailing whitespace, FAIL
tracked-but-deleted file	PASS, no panic (was a Go stack trace)

Not the same as #175

#175 is validate running fewer checks than CI. This is validate running one CI
cannot fail. Both are #68's family, but separate changes in separate files.

🤖 Generated with Claude Code