[CameronBrooks11]

Follows #77, the kindkit pin bump, which is merged. This branch has
main merged into it (no rebase); the diff against main is this change
alone.

What

rowspec CI now calls kindkit's reusable workflow, following kindkit's
README section "Adopting it where conformance is already a required
check".

• New job kind in .github/workflows/check.yml. It calls
  kindspec/kindkit/.github/workflows/kind.yml@8e21b558c85d5612009f3a1d69a3a68bc0191637
  with:

  fixture-root:          conformance/cases
  suite:                 cd conformance && uv run python run_cases.py
  second-implementation: cd conformance && uv run python run_cases.py rowspec_alt.table
  mutants:               cd conformance && uv run python mutants.py
  

  The job grants contents: read and actions: read, which the workflow
  needs to find its own commit. It reports as kind / conformance.

• The conformance job keeps its name. Its required check keeps
  reporting, so the existing ruleset still applies. It drops the just conform, just mutants and just conform-alt steps, which are now the
  workflow's gates. It keeps everything the workflow does not cover:
  just check, the extra-absent assertion, just test without the extra,
  and the example recipe.

• xlsx-extra and action-selftest.yml are unchanged.

• No rowspec gate code changed. mutants.py calls kindkit.gate(),
  and at 8e21b55 that call writes KINDKIT_GATE_REPORT itself. Its probe
  goes through probe_command, which now carries the runner's root
  through. run_cases.py is built on kindkit.cli, which reads
  KINDKIT_REPORT_JSON.

just test still runs the suite and the gate itself, through
tests/test_conformance.py, as it did before. So the conformance job
still exercises them, but under pytest rather than as gate steps.

The workflow ref and the dev pin stay in step

kindkit's commit now appears in two places: uses: in check.yml, and
the dev dependency group in pyproject.toml. The workflow fetches
kindkit's tools/ at the first. The runner and the gate those tools drive
are the package pinned by the second. If the two differ, the gates check a
report contract that the installed kit may not keep.

tests/test_pins.py::test_the_kindkit_workflow_runs_at_the_commit_the_package_is_pinned_to
finds every uses: of a kindspec/kindkit workflow and requires each one
to name the dev group's commit. It also fails if it finds no such uses:
at all, so it cannot pass vacuously. Comments in pyproject.toml,
check.yml and AGENTS.md all say to move the two together.

The owner and the repository are matched case-insensitively, because
GitHub treats KindSpec/KindKit as the same repository. The commit must
still be lowercase hex. Review found the gap: with the original
case-sensitive pattern, a second job calling
KindSpec/KindKit/.github/workflows/kind.yml@bf716e3... beside the correct
ref passed (1 passed).

The test was shown to fail. Each mutation was applied to the file,
hash-checked to confirm it changed, and then reverted. This is the sweep
after the fix:

mixed-case-second-ref-old-sha: killed        second job, KindSpec/KindKit@bf716e3...
mixed-case-second-ref-correct-sha: SURVIVED  control: KindSpec/KindKit@8e21b55..., which is correct
mixed-case-only-ref-old-sha: killed          the only ref, KindSpec/KindKit@bf716e3...
uppercase-sha: killed                        kind.yml@8E21B558...
workflow-ref-old-sha: killed                 uses: ...kind.yml@bf716e3...
workflow-ref-branch: killed                  uses: ...kind.yml@main
pyproject-pin-old: killed                    kindkit @ git+...@bf716e3...
no-kind-job: killed                          no kindkit uses: at all

CI, green and red

Green on the current head (3ce2477): run
37715625047,
with every context green, kind / conformance included. Green on the first push: run
37713862672.
Every step of every job is green, kind / conformance included. From the
kind / conformance job log (job 113105742193):

kindkit at 8e21b558c85d5612009f3a1d69a3a68bc0191637
0 invalid case(s) across 410 case(s) in 1 tree(s)
0 failure(s) across all 410 case(s) under 'conformance/cases'      # reference
0 failure(s) across all 410 case(s) under 'conformance/cases'      # rowspec_alt.table
73 killed, 0 survived, 2 equivalent, 0 stale, 0 broken
the gate killed 73 mutant(s) of '/home/runner/work/rowspec/rowspec/reference/rowspec/table.py' over all 410 case(s)

The gate figures are the same as just mutants gives on main. The
source line names reference/rowspec/table.py. The workflow does not
check which file was mutated (kindkit README), so a reviewer has to.

Red on a throwaway branch: run
37713891424.
tmp/red-demo-broken-case was this branch with one expectation broken:
eval/aggregate-over-an-exponent-name-is-a-broken-reference wanted
#REF!(1e4) instead of #REF!(1e3). Its throwaway PR was #79, which is
now closed, and the branch is deleted. Steps of kind / conformance (job
113105834937):

the case tree follows the convention                     success
the reference implementation passes every case in tree   failure
the second implementation passes every case in tree      failure
the suite must be able to fail                           success

with

  FAIL eval/aggregate-over-an-exponent-name-is-a-broken-reference  o: wanted '#REF!(1e4)', got '#REF!(1e3)'
1 failure(s) across all 410 case(s) under 'conformance/cases'

The mutation step stays green there by design. The gate counts kills
against the baseline's failing set, and that run logged baseline-fail:
for the broken case. So a wrong expectation is the suite steps' job to
catch, not the gate's. The conformance job also went red, at just test.

Required checks: one ruleset edit, immediately before merge

conformance, xlsx-extra, passes-on-a-good-tree and
fails-on-a-broken-total all still report on this branch. So the PR is
mergeable under today's ruleset. But kind / conformance would gate
nothing until it is required (kindspec/.github AGENTS.md §3.2: a new
workflow is not required by default).

The owner's edit: immediately before merging this PR, and not in it,
add kind / conformance (integration 15368, GitHub Actions) to the
required status checks of ruleset 22723542. Keep all four existing
contexts. This is an addition, not a swap: the conformance job still
exists and still reports. So no context goes unreported on this branch,
before or after the edit.

gh api repos/kindspec/rowspec/rulesets/22723542 > rs.json
jq '(.rules[] | select(.type=="required_status_checks") | .parameters.required_status_checks)
      += [{"context":"kind / conformance","integration_id":15368}]
    | {name, target, enforcement, conditions, bypass_actors, rules}' rs.json > rs-new.json
diff <(jq -S '{name,target,enforcement,conditions,bypass_actors,rules}' rs.json) <(jq -S . rs-new.json)   # one added context, nothing else
gh api -X PUT repos/kindspec/rowspec/rulesets/22723542 --input rs-new.json

The diff line was run against the live ruleset, without the PUT. It
shows exactly the one added context. After the edit, any other open branch
that does not have this change sits at Expected for kind / conformance
until it takes it, and strict makes it do that anyway.

Order: #77 is merged and this branch is up to date with main. The
owner adds the required check immediately before merging this PR, then
merges it.

Not changed here

• release.yml's gate job still runs just conform, just mutants
  and just conform-alt directly. It is not a required check, and moving
  it onto the workflow is a separate change.
• kindkit's README still says "rowspec's CI is still its own". That
  needs a kindkit PR once this merges. Whether A reusable CI workflow that runs the suite, the gate, and the second implementation kindkit#4 and spec: the declaration production forbids trailing whitespace a fixture requires #3
  close at that point is the owner's call; this PR does not close them.
• kindspec/.github STATE.md and AGENTS.md §3.1 list rowspec's
  required checks, and will need kind / conformance added once the
  ruleset edit is made.

Refs kindspec/kindkit#4
Refs kindspec/kindkit#3