test(processor): guard -update against CI misuse; drop agent report md

internal/processor/wholefile_test.go

@@ -65,6 +65,12 @@ func runWholeFileCase(t *testing.T, tc wholeFileCase) {
 
 	golden := src + ".golden"
 	if *update {
+		// Goldens are hand-verified expected values. Regenerating under CI would
+		// let the suite pass unconditionally while overwriting the checked-in
+		// goldens — the exact regression the golden strategy exists to catch.
+		if os.Getenv("CI") != "" {
+			t.Fatal("-update must not be used in CI: it overwrites goldens and makes assertions trivially pass")
+		}
 		if err := os.WriteFile(golden, got, 0644); err != nil {
 			t.Fatalf("update golden: %v", err)
 		}