feat(validate): replay explicit tier gating onto main

[rng1995]

Summary

• Replays the explicit Tier 2/Tier 3 gating change from feat(validate): add explicit Tier 2 and Tier 3 gating controls #23 directly onto current main.
• Keeps Tier 1 always blocking, Tier 2 blocking by default, and Tier 3 advisory by default.
• Adds --no-block-on-dedup so Tier 2 can keep scanning and reporting without gating.
• Adds --block-on-agent-eval so Tier 3 results and invalid selected task-source evidence can gate.
• Finalizes per-tier gating metadata before CLI, JSON, Markdown, and HTML reporting so saved evidence and the process exit code use the same policy.
• Updates the repository README, changelog, and current Fern guides for CLI, Tier 1, Tier 2, Tier 3, reports, CI, and quickstart behavior.

Why this is a new PR

PR #23 merged into the staging branch naren/tier3-provider-preflight, not main. Its base PR #19 was intentionally closed, so GitHub cannot retarget or re-merge #23 itself.

Current main already contains the compatible Tier 3 source/runtime primitives through later merged work. This branch therefore replays only #23's reviewed gating commits and its reporter/exit consistency fix, then rewrites the documentation against the current public structure. It does not resurrect the obsolete #19 branch.

Supersedes #23 for the main release line.

Before / after behavior

Scenario	Before on main	After
Tier 1 failure	Blocks	Blocks
Tier 2 finding	Blocks, or Tier 2 must be skipped with --no-dedup	Blocks by default; --no-block-on-dedup keeps evidence advisory
Tier 3 finding	Always advisory inside validate	Advisory by default; --block-on-agent-eval makes it blocking
Missing/invalid Tier 3 source	Discovered later in live execution	Preflighted before execution and reported with the selected gate policy
Report vs. exit policy	Tier assumptions were implicit	Every result records finalized tier/gating metadata consumed by all reporters and exit evaluation

CLI snapshot

Before:

# Tier 2 must be disabled to remove it from the gate
skillevaluator validate ./my-skill --no-dedup

# Attached Tier 3 cannot block
skillevaluator validate ./my-skill --tier3

After:

# Keep Tier 2 findings in reports without blocking
skillevaluator validate ./my-skill --no-block-on-dedup

# Make attached Tier 3 and its source preflight blocking
skillevaluator validate ./my-skill --tier3 --block-on-agent-eval

Documentation

• README: concise default and override behavior.
• Fern CLI reference: flags, defaults, accepted Tier 3 sources, and examples.
• Tier guides: effective gate behavior at each tier.
• CI guide: progressive adoption from advisory evidence to blocking Tier 2/Tier 3.
• Reports guide: finalized gating metadata and report/exit consistency.
• Quickstart and changelog: discoverability and release record.

Validation

• 3665 passed, 13 skipped, 3 deselected — complete repository suite on Python 3.13.
• 225 passed — reporting, commands, source preflight, policy, evaluation service, and CLI-golden matrix.
• ruff check . passed.
• CLI surface golden passed.
• fern check passed with 0 errors.
• Wheel and source distribution build passed.
• OSS-boundary scan passed.
• git diff --check passed.
• All three commits include DCO sign-off.

Risk controls

• Backward-compatible defaults preserve current exit behavior.
• Advisory tiers remain visible in terminal and saved reports.
• Reporters and exit evaluation consume the same finalized result objects.
• No internal provider, managed runtime, private endpoint, Milvus, telemetry, or retired feat(tier3): add trusted coverage and provider preflight #19 dependency work is introduced.

[rmalani-nv]

Two small suggestions for more robustness in the solution. Overall, looks great!