Add regression tests preventing committed tool binaries

[Copilot]

CodeQL alert #653 (workflow-out-of-context) flagged pre-built actionlint (~8MB) and gosec (~69MB) binaries committed to git history — assessed as accidental local build artifacts. Verification shows the remediation is already in place; what was missing is anything preventing it from recurring.

Current state (verified, no changes needed)

• Neither binary is tracked: git ls-files returns no match, in the root or any subdirectory.
• .gitignore already lists /actionlint and /gosec.
• Tooling resolves through the module graph, not vendored binaries: the tools target runs go install github.com/rhysd/actionlint/cmd/actionlint and go install github.com/securego/gosec/v2/cmd/gosec; security-gosec runs go tool gosec; make actionlint shells out to ./gh-aw compile --actionlint.

Added: pkg/cli/tracked_binaries_test.go

• TestNoToolBinariesTracked — enumerates tracked paths via git ls-files -z and fails if any basename matches a build-time tool (actionlint, gosec, govulncheck, golangci-lint, gopls). Basename matching catches a binary dropped in a subdirectory, not just the repo root.
• TestToolBinariesGitignored — asserts the /actionlint and /gosec entries survive future .gitignore edits.

Both follow existing conventions in the package: //go:build !integration, testify, and skip (rather than fail) when git or the repo root is unavailable.

for _, name := range toolBinaryNames {
	path, found := byName[name]
	assert.Falsef(t, found, "Tool binary %q must not be committed (found at %q); it is installed via `go install`/`go tool`", name, path)
}

Out of scope

Purging the blobs from historical commits requires a history rewrite and force-push to main, which is a maintainer decision and cannot be done from this PR. The alert's threat assessment (4/10, accidental, provenance matches upstream gosec v2.27.1) suggests removal from the tree is likely sufficient, but that call is yours.

• Fixes [uk-ai-resilience] Remove committed actionlint/gosec binaries flagged out-of-context (#653) #52527

[Copilot]

Pull request overview

Adds regression tests to prevent build-time tool binaries from being committed again.

Changes:

• Detects tracked tool binaries by basename.
• Verifies existing .gitignore protections remain present.

Show a summary per file

File	Description
pkg/cli/tracked_binaries_test.go	Adds binary-tracking and ignore-entry regression tests.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced