feat(yaml): KYAML batch 1 + ratchet; withdraw blindness claim

[hyperpolymath]

Part of #1024 (YAML-POLICY §5 step 5). Owner ruling D280 (#787).

What

• Converts _shared/container/.gatekeeper.yaml to KYAML using scripts/kyaml-format.sh, which runs yq -p yaml -o kyaml '.' verbatim.
  • tools/yaml-comment-proof: 64/64 comments preserved, idempotent, data-equal. Both control mutants were killed.
• Ratchet: Self Test gains a step, Converted YAML stays KYAML, that runs kyaml-format.sh --check over every converted file. Positive control: the block-style original fails, rc=1.
  • It adds no new uses:, so actions.lock is untouched.
  • The runner's yq already passes the kyaml-format suite (17/17 on main 71bb615).
• Correction: withdraws YAML-POLICY §5 step 3's claim that "gh actions-lock is blind to KYAML". I re-tested with the same ref planted in each syntax, and the two syntaxes gave identical verdicts:

planted ref	block	KYAML
tag actions/setup-node@v4	rc=1	rc=1
bare SHA not in lock	rc=0	rc=0

Fix mode also left a KYAML workflow byte-identical and kept its lock entries. The gap that remains has nothing to do with syntax and is tracked in #1025.

Scope (denominator)

This repo tracks 187 *.yml/*.yaml files:

• 113 are workflows (step 6, KYAML step 6/6 — workflows, only if step 4 rules them in scope #1025), including templates in satellites.
• 74 are not workflows:
  • 1 is converted in this PR.
  • 2 are the proof's own calibration fixtures, which must stay as they are.
  • The other 71 are read by third-party bots or are vendored satellite copies: Dependabot, FUNDING, issue forms, GitLab CI, Copilot, composite actions, compose, k8s, OpenAPI, stack. These need an owner call (see KYAML step 5/6 — migrate estate-authored non-bot YAML #1024).

🤖 Generated with Claude Code

https://claude.ai/code/session_01W5CoaksP2Bg21HpDCgFgwS

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f381d2b5-eb38-4a25-a9b0-cf7799bffd78

📥 Commits

Reviewing files that changed from the base of the PR and between 71bb615 and f027fba.

📒 Files selected for processing (3)

• .github/workflows/self-test.yml
• 3-practice/YAML-POLICY.adoc
• _shared/container/.gatekeeper.yaml

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}