feat: default to kapi 1.2.0 and fetch history for diff-scoped gates

[asgeirf]

Merge after kapi 1.2.0 is published. The new default names a release that does not exist until then.

Summary

• kapi-version defaults to 1.2.0 in up.yml and gate.yml (was 1.2.0-rc14). The input description says it also takes latest, which setup-kapi resolves to the newest stable release.
• gate.yml takes fetch-depth (default 1) and passes it to actions/checkout. A diff-scoped check reads the commits it compares. In the depth-1 checkout gate.yml had, kapi check --diff-range fails with "HEAD~1" names no commit, so no caller could run one through this workflow on any kapi version. The README shows the fetch-depth: 0 form.
• The gate.yml comments and the README name the current gates (voice, terminology, rule-based checks) and the unit state kapi commit writes under .kapi/state/. The retired .kapi-state.json is gone from both.
• test.yml calls both reusable workflows from this checkout on a source-only fixture with kapi 1.2.0-rc32. It runs check --ship, a --diff-range check over the commit that last changed the fixture, and kapi up, and a verify job checks each output. The fixture needs no provider key and no server, and it converges with no changes, so nothing is delivered.

Evidence

Local, rc32 against rc14 on the same source-only project:

• rc32 kapi up --json: exit 0, "converged":true.
• rc32 check --ship: PASS.
• rc32 check --diff-range HEAD~1..HEAD -p test/fixture/kapi.yaml, run from the repository root: exit 0, the changed file checked.
• rc14 kapi up: no target languages configured.
• rc14 check --diff-range: unknown flag: --diff-range.
• rc32 in a --depth 1 clone: exit 128, "HEAD~1" names no commit.

The must-fail runs on main's gate.yml and the green run of this branch are linked in a comment below.

Proposed tag

v1.2.0. Every @v1 caller that does not pin kapi-version gets a different CLI, including a kapi check that no longer passes when it checked nothing. The PR also adds an input, which is more than a fix.

Notes

up.yml, gate.yml and test.yml pin actions/checkout@v6; v7 is current.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VRid8i4qnuNfE7Lio73Uu4

[asgeirf]

Evidence from real runs.

This branch: Test run 34952398751 passed all five jobs:

• gate.yml: check --ship
• gate.yml: a diff-scoped check, with --diff-range <sha>~1..<sha> and fetch-depth: 0
• up.yml: kapi up on the source-only fixture
• the verify job, which found both gates pass, up converged and has-changes false

All of them use kapi 1.2.0-rc32.

Must fail, main's gate.yml: run 34952404716, from the throwaway branch test/main-gate-must-fail, called neokapi/kapi-workflows/.github/workflows/gate.yml@main with --diff-range over the fixture commit. Both jobs failed.

• Default kapi-version, Resolved version: 1.2.0-rc14:

  Error: unknown flag: --diff-range
  ##[error]kapi check failed operationally (exit 1)
  

• kapi-version: 1.2.0-rc32, in main's depth-1 checkout:

  Error: "98d6cca2db5f14a0c50a292deece3b27d3c46e14~1" names no commit: exit status 128: fatal: Needed a single revision
  ##[error]kapi check failed operationally (exit 128)
  

The first job fails on the old default. The second fails on the missing history, which the new fetch-depth input fixes.