Merge PR #2 (dabao1955): expand the CI matrix, and finish the dcc.py declaration

The PR diagnosed the same CI failure this branch had just fixed, from the other end, and two of its
three changes are kept.

  .github/workflows/ci.yml   KEPT. The matrix was ["3.11", "3.13"] while the frontmatter claims
                             Python 3.9+; it is now 3.11-3.14. Both new versions were checked here
                             before taking it: the gates and the full suite pass on 3.12 and 3.14.
  check_commands.py          KEPT. dcc.py added to EXTERNAL_SCRIPTS. This branch reached the same
                             conclusion structurally -- recognition by filename needs the gitignored
                             tools/ tree to exist -- and the explicit entry is the better belt for
                             the same braces, because it names the situation instead of inferring it.
                             Both spellings are declared: the bare dcc.py the java2c record uses
                             and the ./dcc.py this branch''s record uses.
  its new test               KEPT, with one assertion corrected. It pinned workbench-after-cd when
                             the workbench was present and xternal when it was not, so it asserted
                             one mechanism at a time -- and would have failed on any machine with
                             tools/ present once the declaration above exists, i.e. it was itself
                             machine-dependent, which is the defect the test guards. It now asserts
                             the property both mechanisms produce.

Verified on the merged tree, in both shapes: with tools/ present, 619 passed / 158 skipped / 25
xfailed and all five gates exit 0; with tools/ hidden to imitate a clean checkout, 596 passed / 181
skipped / 25 xfailed and all five gates still exit 0. The second shape is the one CI runs, and it is
the check that was missing when the previous commit was pushed.

.github/workflows/ci.yml

@@ -36,7 +36,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.13"]
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
 
     env:
       PYTHONIOENCODING: utf-8

check_commands.py

@@ -94,12 +94,22 @@ EXTERNAL_SCRIPTS = {
         "blutter's own environment script, run from inside the blutter checkout -- the "
         "record's preceding line is `git clone --depth 1 worawit/blutter` "
         "(docs/tool-verification/TOOL-VERDICTS.md)",
+    # Both spellings of the same upstream entry point are declared, because the two records write
+    # it differently and each spelling has to stand on its own: `./dcc.py` (invoked from inside its
+    # checkout) and the bare `dcc.py` after a `cd` into it. Both are here for the same reason --
+    # the `cd`-then-bare-name form only skips while the gitignored `tools/` tree happens to exist,
+    # so recognition by filename alone reported drift on a clean checkout.
     './dcc.py':
         "the entry point of the dcc checkout, invoked as `./dcc.py` from inside it after "
         "`cd tools/_work/bench/repos/dcc` -- the `./` is what says so, and this repository "
-        "ships no dcc.py. Declared rather than inferred: the `cd`-then-bare-name form only "
-        "skips while the gitignored tools/ tree happens to exist, so on a clean checkout the "
-        "same line degraded to drift (docs/tool-verification/EXTENSION-reconstruction.md)",
+        "ships no dcc.py (docs/tool-verification/EXTENSION-reconstruction.md)",
+    'dcc.py':
+        "the dcc tool's own entry point, run from inside its checkout -- the record's "
+        "preceding line is `cd tools/_work/bench/repos/dcc`, and this repository ships "
+        "no dcc.py (docs/tool-verification/EXTENSION-java2c.md). Declared rather than "
+        "inferred because the `cd`-then-bare-name form only skips as workbench-after-cd "
+        "while the gitignored tools/ tree happens to exist locally; a clean checkout has "
+        "no such file to recognise, and without this entry the gate reported drift there.",
 }
 
 # Commands an evidence record *quotes* rather than offers. The key is (document,

tests/integration/test_check_commands_gate.py

@@ -148,6 +148,39 @@ def test_a_bare_name_after_cd_with_no_resolution_is_skipped_not_drift(gate, fake
     assert "after-cd-unresolved" in kinds, findings
 
 
+def test_the_external_dcc_entry_point_is_never_drift(gate):
+    """`python dcc.py` after `cd tools/_work/bench/repos/dcc` runs inside the external dcc
+    checkout, so it is a skip on every machine -- including one without the workbench.
+
+    The name is declared in EXTERNAL_SCRIPTS because recognition by filename needs `tools/` to
+    exist: on a clean checkout `dcc.py` degraded to `missing-script` drift and the gate failed away
+    from the machine that wrote the record. Asserted as a *property* rather than as one specific
+    reason, because two mechanisms can legitimately produce it -- the declared entry point and the
+    workbench-after-`cd` rule -- and pinning either one alone makes the test machine-dependent,
+    which is the very defect it is guarding against.
+    """
+    doc = str(REPO_ROOT / "docs" / "tool-verification" / "EXTENSION-java2c.md")
+    _path, why = gate.resolve_script("dcc.py", doc, include_workbench=False, chdir=True)
+    assert why in ("external", "workbench-after-cd"), why
+
+    text = "```\n$ cd tools/_work/bench/repos/dcc\n$ python dcc.py --no-build\n```\n"
+    findings = gate.command_findings(doc, text, {}, False)
+    kinds = [f["kind"] for f in findings]
+    assert "missing-script" not in kinds, findings
+    assert "unqualified-workbench" not in kinds, findings
+    assert any(k in ("workbench-after-cd", "external") for k in kinds), findings
+
+
+def test_a_shipped_script_resolves_from_the_repository_root(gate):
+    """The order that matters: root, then the skill's scripts, then the document's own directory."""
+    doc = str(REPO_ROOT / "docs" / "tool-verification" / "README.md")
+    path, why = gate.resolve_script("check_repo.py", doc, include_workbench=False)
+    assert why == "ok" and path and path.endswith("check_repo.py")
+    path, why = gate.resolve_script("skills/apk-reverse/scripts/scan_leaks.py", doc,
+                                    include_workbench=False)
+    assert why == "ok" and path and path.endswith("scan_leaks.py")
+
+
 def test_the_committed_tree_reports_no_drift(gate, tmp_path):
     """The gate's own verdict on this repository, run in-process so it cannot drift silently."""
     docs = gate.collect_docs(None)