Add rendered YAML golden file test to catch template/output drift

[tsavo-at-pieces]

Context

WorkflowGenerator.render() produces a full CI workflow YAML from ci.skeleton.yaml + config. There is no test that:

1. Calls render() and validates the output is structurally valid YAML (parseable by package:yaml)
2. Verifies critical jobs exist (pre-check, test, analyze, etc.)
3. Checks that the rendered output matches (or is consistent with) the committed .github/workflows/ci.yaml

The existing render test only checks isNotEmpty and contains('name:') — a very weak assertion.

Proposed tests

test('render produces structurally valid YAML with expected jobs', () {
  final gen = WorkflowGenerator(ciConfig: validConfig, toolingVersion: '0.0.0');
  final rendered = gen.render();
  final parsed = loadYaml(rendered) as YamlMap;
  expect(parsed.containsKey('name'), isTrue);
  expect(parsed.containsKey('on'), isTrue);
  expect(parsed.containsKey('jobs'), isTrue);
  // Verify SDK version interpolated
  expect(rendered, contains('3.9.2'));
});

test('disabling feature flag removes corresponding snippet', () {
  final gen = WorkflowGenerator(
    ciConfig: configWith(features: {'proto': false}),
    toolingVersion: '0.0.0',
  );
  expect(gen.render(), isNot(contains('Install protoc')));
});

Relationship

Related to #12 (template duplication refactor) — a golden file test would catch drift introduced during refactoring.

Identified during PR #29 review.

[tsavo-at-pieces]

Cross-reference: broader hardening and drift-guard context is tracked in #33.\n\nThis issue (#31) remains the targeted rendered-YAML golden/drift test item (also related to #12). #33 tracks the wider trust-boundary hardening pass in parallel.