feat: confront added profiles in CI

profile_sync --strict exits 1 when a profile has refs to review. The
validation workflow runs it on every profile a pull request or a push to
main adds, so a profile whose refs miss their value no longer lands green.

tests/test_audit_regressions.py

@@ -230,6 +230,21 @@ class WorkflowRegressions(unittest.TestCase):
             f"{job} carries a condition; the suite must run on push and on PR",
         )
 
+    def test_added_profiles_meet_their_upstream_on_both_roads(self):
+        """A new profile's refs were confronted only if its author remembered."""
+        workflow = self._workflow("validate.yml")
+        runs = [
+            (name, str(step.get("run", "")))
+            for name, body in workflow["jobs"].items()
+            for step in body.get("steps", [])
+            if "profile_sync.py" in str(step.get("run", ""))
+        ]
+        self.assertTrue(runs, "no job confronts profiles with their upstream")
+        for name, body in runs:
+            self.assertIn("--strict", body)
+            self.assertIn("--diff-filter=A", body)
+            self.assertIsNone(workflow["jobs"][name].get("if"), f"{name} must run on push too")
+
     def test_both_events_watch_the_same_paths(self):
         triggers = self._workflow("validate.yml")["on"]
         self.assertEqual(

tests/test_profile_sync.py

@@ -3804,6 +3804,19 @@ class TestOutputModesApplyTheirFlags(unittest.TestCase):
         self.assertEqual(code, 0)
         self.assertEqual([r["name"] for r in json.loads(out)], ["drift"])
 
+    def test_strict_fails_on_refs_to_review(self):
+        """A new profile whose refs miss their value used to pass CI green."""
+        code, out, _ = self._main("--changed-only", "--strict")
+        self.assertEqual(code, 1)
+        self.assertIn("drift", out)
+
+    def test_strict_passes_when_nothing_is_to_review(self):
+        from unittest import mock
+
+        with mock.patch.object(ProfileReport, "needs_review", return_value=0):
+            code, _, _ = self._main("--strict")
+        self.assertEqual(code, 0)
+
     def test_extras_are_refused_with_json(self):
         code, _, err = self._main("--json", "--check-version")
         self.assertEqual(code, 1)
@@ -3872,7 +3885,7 @@ class TestRealignFlagMatrix(unittest.TestCase):
     def test_output_flags_are_refused(self):
         for flag in (
             "--json", "--markdown", "--fetch-plan", "--triage",
-            "--changed-only", "--check-version", "--detect-new-files",
+            "--changed-only", "--strict", "--check-version", "--detect-new-files",
             "--watch-hashes", "--full-diff", "--tree-diff",
             "--accept-changed",
         ):