[feature] Add provider adapter capability matrix and generated compliance report

[paudley]

Problem statement

coding-ethos supports Codex, Claude Code, Gemini CLI, and generic agent surfaces, but provider capability truth is currently distributed across settings generation, hook output code, docs, MCP behavior, and tests. That makes it hard to answer which provider supports which hook events, block response shape, context injection shape, MCP setup, memory interception, or settings path.

ECC prior art worth porting: its cross-harness posture treats provider support as an adapter/compliance matrix instead of scattered docs. See:

• https://github.com/affaan-m/ECC
• https://raw.githubusercontent.com/affaan-m/ECC/main/docs/ECC-2.0-REFERENCE-ARCHITECTURE.md
• https://raw.githubusercontent.com/affaan-m/ECC/main/docs/capability-surface-selection.md

Proposed solution

Add a machine-readable provider capability registry and generated compliance report.

The registry should cover at minimum:

• provider id and display name
• supported hook events
• block response shape and context/advice shape
• MCP setup support and settings target
• generated skill/docs target paths
• memory interception support and fallback behavior
• known unsupported surfaces and safety caveats
• verification command or fixture that proves the adapter still works

Generate a Markdown compliance matrix from the registry and make docs/checks consume the registry instead of duplicating provider support claims by hand.

Acceptance criteria

• Registry includes Codex, Claude Code, Gemini CLI, and generic fallback.
• Generated docs list supported, partially supported, and unsupported surfaces.
• CI or make check fails if the generated provider matrix drifts from the registry.
• Provider-native output tests reference provider ids from the same registry.
• No provider-specific policy behavior is hidden outside the registry without a test or documented reason.

Implementation notes

Likely ownership is under go/internal/agenthooks or a new narrow provider metadata package, with docs generated into docs/INTEGRATIONS.md or a new provider matrix doc. Keep this as metadata plus validation first; do not rewrite hook behavior in the first pass.

[paudley]

Stage 1 plan for #179:

• Use go/internal/agenthooks as the provider capability registry owner, extending the existing ProviderCapability data instead of creating a separate source of truth.
• Add the generic fallback provider alongside Claude, Codex, and Gemini.
• Generate a Markdown provider capability matrix from the registry and check the checked-in doc for drift in Go tests so make check fails on mismatch.
• Update README/INTEGRATIONS pointers to route provider capability claims to the generated report instead of hand-maintained tables.
• Update provider-native tests so provider ids and capability claims come from the registry.
• Validate with focused Go tests, make build because this changes agent-hook/generated surfaces, then make check before commit/push/PR.

[paudley]

Stage 1 implementation is published in PR #259: #259

Commits:

• 587a614 feat(agenthooks): add provider capability matrix
• b9ee5b0 fix(agenthooks): align provider capability fields

Validation:

• cd go && go test -buildvcs=false ./internal/agenthooks ./internal/agenthookscli
• make build
• make check

make check exits successfully. The managed Go test phase still emits the existing non-blocking warning that Go coverage is below the 90% project goal.

[paudley]

Stage 2 update

Pushed follow-up commit 660f009 to PR #259 after review feedback.

Resolved:

• Provider matrix file mode is now 0644 with test coverage.
• Redundant filepath.Clean calls were removed from the touched provider matrix paths.
• Generated Markdown now keeps readable provider paths; the advertising filter has a regression test for .coding-ethos/gemini/prompt-pack.json.
• check-provider-matrix now depends on the Go tool install path it actually uses.
• Commit-hook-exposed codeintelcli stdout race was fixed.

Skipped the static cached slice suggestion because the repo hook forbids package globals via gochecknoglobals.

Validation: focused Go tests, go test ./internal/codeintelcli -count=30, make build, make check, commit hook, and push hook all passed. The existing Go coverage warning remains non-blocking.