Reusable workflow + gates for a small-model agent

[d-morrison]

Summary

Add a reusable workflow (and supporting composites) that runs a small / self-hosted-model agent against a pull request, using the repo's existing gate composites as the agent's verification checks. This is the runs-it-in-CI half of the small-local-models story — a sibling to the existing claude.yml / gemini.yml AI workflows, but pointed at a small or self-hosted model.

Companion to: d-morrison/wai — "Add guidance on small/local models for (autonomous) agentic coding" (rationale and guardrail reasoning live there); pairs with the ai-config launch-skill issue.

Motivation

gha already centralizes CI for R-package and Quarto repos and already has AI-assisted workflows. The autonomy story in wai depends on environment-run verification gates, and this repo already ships exactly those composites (lint-qmd, lint-markdown, check-links, check-phi, plus R testthat checks). Wiring them as a small-model agent's green/red signal turns the guardrail concept into enforced CI, reusable across consumer repos via stub files.

Proposed content

1. A reusable workflow (e.g. .github/workflows/small-model-agent.yml) that:
   • Runs an agent backed by a small or self-hosted model (OpenAI-compatible endpoint / self-hosted runner) against a PR or issue.
   • Operates on a branch/worktree, commits per green step, and posts a summary — never force-merges.
   • Is bounded (max iterations / consecutive failures → stop and report), mirroring the wai guardrails.
2. Gate wiring — call the existing composites as the agent's per-step verification: lint-yaml, lint-markdown, lint-qmd, check-links, check-phi, check-secrets, and R testthat / R CMD check; add a Quarto quarto render gate and (optionally) act for workflow-file changes.
3. A minimal consumer stub so R/Quarto repos can adopt it with a few lines, consistent with the repo's stub pattern.
4. Docs + cross-link back to the wai page and the ai-config launch skill.

Tasks

• Decide model backing (self-hosted runner vs. OpenAI-compatible endpoint) and secrets handling
• Draft the reusable workflow with bounded-loop + branch/worktree + PR-summary behavior
• Wire existing composites as the verification gates; add a quarto render gate
• Add a consumer stub example
• Document and cross-link wai + ai-config

Notes

Reuse the same gate commands the ai-config skill calls locally, so local and CI runs verify identically. Keep permissions least-privilege (the repo already wraps composites in permission-managed workflows).