Add validation rules for task execution fields

[Copilot]

A Task could silently accept multiple conflicting execution fields with no indication of which would take precedence. This adds validation rules that enforce supported combinations.

Rules

• command and sh are mutually exclusive (both specify how to invoke the process)
• manifests cannot be combined with image, command, or sh (Kubernetes manifest tasks are a distinct execution model)
• image may be combined with command or sh (the command overrides the container entrypoint)

Changes

• internal/types/task.go — Added Task.Validate() method enforcing the above rules
• internal/run.go — Calls Validate() on all tasks at the start of RunSubgraph before any execution begins
• internal/types/task_test.go — Tests covering valid and invalid field combinations
• internal/run_test.go — Test asserting that an invalid task produces the expected wrapped error from RunSubgraph

Example

A task like this now fails fast with a clear error:

tasks:
  bad-task:
    sh: echo hello
    command: [echo, hello]

task "bad-task" is invalid: only one of command or sh is allowed

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR introduces a Task.Validate() method intended to prevent ambiguous task execution by enforcing mutual exclusivity across task execution-related fields, and wires that validation into RunSubgraph so invalid workflows fail before execution begins.

Changes:

• Added (*types.Task).Validate() to detect conflicting execution fields and return a descriptive error.
• Added early validation in internal.RunSubgraph to fail fast on invalid tasks.
• Added unit tests for Task.Validate() conflict scenarios.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
internal/types/task.go	Adds Task.Validate() for execution-field conflict detection.
internal/run.go	Calls Validate() on all tasks before any execution begins.
internal/types/task_test.go	Adds tests validating the new mutual-exclusivity behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

RunSubgraph now fails fast by validating tasks before execution, but there’s no test coverage asserting that an invalid task produces the expected wrapped error (e.g. task %q is invalid: ...). Adding a small case in internal/run_test.go would prevent regressions and ensure the new validation is actually exercised in the runner path.

[alexec]

@copilot apply changes based on this feedback

[Copilot]

Added a "Invalid task" test case to internal/run_test.go that verifies an invalid workflow (task with both command and sh) returns the expected wrapped error task "job" is invalid: only one of command or sh is allowed. Also fixed the task_test.go error message expectations to align with the updated Validate() implementation. Commit: 674557a