fix: ecosystem health — compat matrix, lint, submodule sync (#10)

* fix: resolve compat matrix collision and sync ecosystem submodules

Rename root compatibility-matrix.json to platform-capabilities.json so
compat-test reads testdata/compatibility-matrix.json. Fix noctx across
codegraph, tools, and bench; use go work sync for tidy; bump external/*
submodules to latest main.

* style: gofumpt codegraph cgo files for CI format gate

Author: Patel230

COMPATIBILITY.md

@@ -4,7 +4,9 @@ This eco uses **independent SemVer per repo** (see [VERSIONING.md](./VERSIONING.
 That gives each component its own release cadence, but raises an obvious
 question: *which combinations of versions are actually tested together?*
 
-The answer lives in [`compatibility-matrix.json`](./compatibility-matrix.json).
+The answer lives in [`testdata/compatibility-matrix.json`](./testdata/compatibility-matrix.json).
+
+Platform/provider capability metadata is separate: [`platform-capabilities.json`](./platform-capabilities.json).
 
 ## What it records
 
@@ -46,7 +48,7 @@ existing consumers.
 `.shared-templates/workflows/compatibility-test.yml.tmpl` is a reusable
 workflow that:
 
-1. Reads `compatibility-matrix.json` from the eco repo.
+1. Reads `testdata/compatibility-matrix.json` from the hawk repo.
 2. Checks out each component at the version listed in the named matrix.
 3. Builds + tests the cross-repo integration scenarios.
 
@@ -68,21 +70,14 @@ It runs on:
 
 ## Validating the file
 
-The file is validated against [`compatibility-matrix.schema.json`](./compatibility-matrix.schema.json)
+The file is validated against [`testdata/compatibility-matrix.schema.json`](./testdata/compatibility-matrix.schema.json)
 in CI. To validate locally:
 
 ```bash
-# Quick check using ajv (Node)
+make compat-check   # structural validation + version pins
+
+# Or with ajv (Node)
 npx ajv-cli validate \
-  -s compatibility-matrix.schema.json \
-  -d compatibility-matrix.json
-
-# Or with Python
-python3 -c "
-import json, jsonschema
-schema = json.load(open('compatibility-matrix.schema.json'))
-data   = json.load(open('compatibility-matrix.json'))
-jsonschema.validate(data, schema)
-print('ok')
-"
+  -s testdata/compatibility-matrix.schema.json \
+  -d testdata/compatibility-matrix.json
 ```

Makefile

@@ -106,8 +106,8 @@ security: ## Run govulncheck.
 	@command -v $(GOVULNCHECK) >/dev/null 2>&1 || (echo "install: go install golang.org/x/vuln/cmd/govulncheck@latest" && exit 1)
 	$(GOVULNCHECK) ./...
 
-tidy: ## Tidy go.mod / go.sum.
-	go mod tidy
+tidy: ## Sync workspace modules and verify checksums.
+	go work sync
 	go mod verify
 
 # ---------------------------------------------------------------------------
@@ -190,11 +190,11 @@ help: ## Show this help.
 # ---------------------------------------------------------------------------
 .PHONY: compat-test compat-check
 
-compat-test: ## Validate compatibility-matrix.json and report the 'next' matrix.
-	@go run ./cmd/compat-test -matrix=next
+compat-test: ## Validate testdata/compatibility-matrix.json and report the 'next' matrix.
+	@go run ./cmd/compat-test -matrix=next -file=testdata/compatibility-matrix.json
 
 compat-check: ## Strict validation — non-zero exit if any component lacks a version.
-	@go run ./cmd/compat-test -matrix=next -strict
+	@go run ./cmd/compat-test -matrix=next -strict -file=testdata/compatibility-matrix.json
 
 .PHONY: hooks
 hooks:

cmd/compat-test/main.go

@@ -160,17 +160,23 @@ func report(mf matrixFile, m matrix, strict bool) error {
 	return nil
 }
 
-// findMatrixFile looks for compatibility-matrix.json in the current dir, then
-// walks up looking for one. Returns "" if not found within 6 levels.
+// findMatrixFile locates the cross-repo compatibility matrix (testdata/compatibility-matrix.json).
+// It must not pick hawk/platform-capabilities.json, which is a different document.
 func findMatrixFile() string {
 	dir, err := os.Getwd()
 	if err != nil {
 		return ""
 	}
+	candidates := []string{
+		"testdata/compatibility-matrix.json",
+		"hawk/testdata/compatibility-matrix.json",
+	}
 	for i := 0; i < 6; i++ {
-		p := filepath.Join(dir, "compatibility-matrix.json")
-		if _, err := os.Stat(p); err == nil {
-			return p
+		for _, rel := range candidates {
+			p := filepath.Join(dir, rel)
+			if _, err := os.Stat(p); err == nil {
+				return p
+			}
 		}
 		parent := filepath.Dir(dir)
 		if parent == dir {

cmd/testfirst_workflow.go

@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"os/exec"
@@ -84,7 +85,7 @@ func RunTestFirstWorkflow(cfg TestFirstConfig, chatFn ReviewChatFn) TestFirstRes
 
 // runTests executes the test command and returns output + pass status.
 func runTests(testCmd string) (string, bool) {
-	cmd := exec.Command("sh", "-c", testCmd)
+	cmd := exec.CommandContext(context.Background(), "sh", "-c", testCmd)
 	cmd.Dir, _ = os.Getwd()
 	out, err := cmd.CombinedOutput()
 	output := strings.TrimSpace(string(out))