Document deterministic staging targets for testing the install gate

[juangaitanv]

What

Adds a "Testing the gate" subsection to skills/corgea/SKILL.md (Unit 7, docs-only), placed after the install-wrapper flag table and env-overrides sentence.

• Staging vuln-api URL (CORGEA_VULN_API_URL=https://cve-worker-staging.corgea.workers.dev) and the note that it ignores auth — any non-empty CORGEA_TOKEN enables full-gate mode.
• Deterministic known-vulnerable targets: npm axios@0.21.0 (fix 0.21.2), minimist@0.0.8 (fix 1.2.2), node-fetch@2.6.0 (fix 2.6.7); PyPI mezzanine==6.0.0 (no fixed version).
• Copy-paste verification command with expected output.
• Caveat: the staging PyPI seed is recent-CVEs-only — pyyaml==5.1 and django==2.2 return clean by design.

Verification

• Built the release binary and ran the documented command against staging with CORGEA_TOKEN=dogfood-dummy; the expected output in the doc is the real observed output (exit 1, nothing installed).
• Confirmed every table row against staging via curl …/v1/packages/<eco>/<pkg>/versions/<v>/check: axios/minimist/node-fetch vulnerable with the listed fixes, mezzanine vulnerable with no fixed version, pyyaml 5.1 and django 2.2 clean.
• ./harness check passes (clippy, fmt, 252 tests, deps-skill drift).

[cursor]

No actionable findings.

Verified the PR diff against origin/install-vuln-gate: the only change is the new skills/corgea/SKILL.md gate-testing section. I cross-checked the documented assumptions against the implementation and live staging service:

• CORGEA_TOKEN is the install-gate token source (src/config.rs, src/main.rs), and a trimmed non-empty value enables vuln verdict mode.
• The staging worker currently returns the documented vulnerable verdicts for axios@0.21.0, minimist@0.0.8, node-fetch@2.6.0, and mezzanine==6.0.0; it also returns the axios verdict without an auth header, matching the “ignores auth” note.
• The documented axios example’s tree count matches live npm lockfile resolution: axios@0.21.0 plus follow-redirects, with one transitive package.
• The output text in the example matches the renderer paths for precheck summary, tree summary, vulnerable advisory lines, safe-version selection, and refusal wording in src/precheck/mod.rs.
• The “nothing is installed” claim is supported by the blocking path returning before exec(), and by existing tests that assert the package manager is not invoked for vulnerable verdicts plus that npm resolution does not touch the project lockfile.

I attempted to run the documented CLI example end-to-end, but this cloud image only has Cargo 1.83 and the current dependency set requires edition2024 support, so the binary could not be built locally. That environment issue did not reveal a PR-specific merge blocker.

  

_{Sent by Cursor Automation: pr-flow}