mindicator/invAIriant audit gate

Validate an invAIriant audit report, verify its provenance binding, render it into the job summary, and fail CI on open S0/S1 findings.

Trust Signals

name	description	required	default
report	Path (in your repo) to the audit report JSON to validate and gate on.	no	""
max-severity	ci-gate blocking level: S1 (default, blocks S0+S1) or S0 (blocks only S0).	no	S1
require-provenance	If "true", fail when the report carries no provenance block (default: warn only — staged rollout of issue #2).	no	false
collect	If "true", also generate an evidence bundle at invairiant-bundle.json (for artifact upload / an agent step).	no	false
scope	bounded scope for collect: working \| range \| commit \| module \| adr \| rp \| pr \| repo (empty = working, or range if 'range' is set).	no	""
range	git range for collect, e.g. origin/main...HEAD (--scope range).	no	""
commit	commit sha for collect (--scope commit).	no	""
pr	pull-request number for collect (--scope pr; needs a GitHub remote + gh/token or the pull ref).	no	""
path	module dir/file, ADR file, or refactoring-proposal file for collect (--scope module\|adr\|rp).	no	""
narrow	restrict an adr/rp scope's code to this subtree (--narrow).	no	""
invairiant-ref	Git ref of mindicator/invairiant to run (tag/branch/sha).	no	v0.3.0

no outputs