test(scenario-100): config-derived Jenkins + CircleCI CI generation proof (#804)

[intel352]

Summary

PR 3 of 3 for workflow#804. Adds scenario 100 — a behavior proof that wfctl ci generate --platform jenkins and --platform circleci now produce config-derived CI output via cigen (RenderJenkins/RenderCircleCI), shipped in workflow v0.68.0 (PR #810).

What it proves (acceptance #1 — the CLI path)

test/run.sh runs the real wfctl ci generate against a config that exercises every cigen derivation and asserts the emitted Jenkinsfile / .circleci/config.yml contain: secret env wiring, wfctl migrations up (never wfctl ci run --phase migrate), a /healthz smoke check, a plan-guard that exit 1s on replace/destroy, and wfctl infra apply — and are free of the retired legacy stages (go test ./..., wfctl deploy --image, docker build) per ADR 0044. It also validates a step.ci_generate config targeting jenkins/circleci (config-shape; the behavior half of acceptance #2 is the ci-generator plugin's integration_test.go).

Demonstration-fidelity: executes the real artifact, not a reimplementation.

Evidence (real run, committed)

test/artifacts/last-run.log — 22 passed, 0 failed, 0 skipped against wfctl built from the workflow #804 branch:

PASS: wfctl ci generate --platform jenkins succeeded
PASS: jenkins: 'wfctl migrations up' migration step present
PASS: jenkins: credentials('APP_DB_URL') binding
PASS: jenkins: no retired legacy stages
PASS: wfctl ci generate --platform circleci succeeded
PASS: circleci: version 2.1
PASS: circleci: workflow requires: graph
...
Results: 22 passed, 0 failed, 0 skipped

Note

• Scenario id 100 (the plan guessed 97; 97–99 were already taken — used the actual next-free slot).
• The harness skips cleanly if no suitable wfctl is found; CI builds wfctl from the sibling workflow checkout (now on main with v0.68.0).
• Copilot review intentionally not requested (Copilot review broken).

🤖 Generated with Claude Code