cigen: smart generation for Jenkins + CircleCI (currently template-only)

[intel352]

Context

workflow/cigen (shipped v0.67.0) does config-derived analyze → CIPlan → render for GitHub Actions and GitLab CI only. workflow-plugin-ci-generator v0.2.0 routes those two platforms through cigen but keeps the legacy template generators for Jenkins and CircleCI (internal/platforms/{jenkins,circleci}.go), which are NOT config-derived (they ignore the app's secrets union, phases, migrations, smoke, plugin-install needs).

Documented as out-of-scope/future in the design: docs/plans/2026-05-30-wfctl-secrets-wizard-and-smart-ci-design.md §3 non-goals; retro docs/retros/2026-05-30-...-retro.md.

Ask

Add cigen.RenderJenkins(*CIPlan) + cigen.RenderCircleCI(*CIPlan) so all four platforms are config-derived from the same CIPlan, then route the plugin's jenkins/circleci platforms through cigen (retire the templates, like GHA/GitLab in PR #18).

Renderers are mechanical emitters from the existing CIPlan model (jobs/stages, secret env refs, wfctl migrations up, plan-guard, smoke) — no Analyze change needed; the plan already carries everything.

Acceptance

• wfctl ci generate --platform jenkins / circleci produce config-derived output (secret env wiring, migrations step, smoke) — verifiable like the GHA renderer's golden tests.
• step.ci_generate for jenkins/circleci routes through cigen; jenkins/circleci template generators removed.

Effort: medium (2 renderers + plugin rewire + tests). No new analysis logic.

[intel352]

Shipped across a 3-PR cross-repo cascade:

• workflow feat(cigen): config-derived Jenkins + CircleCI renderers + wfctl four-platform support (#804) #810 → v0.68.0: cigen.RenderJenkins + cigen.RenderCircleCI (config-derived emitters from the existing CIPlan, mirroring the GHA job set); wfctl ci generate now supports all four platforms. ADR 0044 documents the deliberate drop of the legacy docker-build/wfctl deploy stages.
• workflow-plugin-ci-generator Fix 3 UI bugs found during exploratory testing #21 + Bump github.com/aws/aws-sdk-go-v2/config from 1.31.0 to 1.32.7 #22 → v0.3.0: step.ci_generate routes jenkins/circleci through cigen; the entire internal/platforms template package was retired. (v0.2.0 was already released for Phase 4: EventBus integration for inter-workflow eventing #18, so this bumped to v0.3.0.)
• workflow-scenarios Fix CronScheduler: replace hardcoded interval switch with proper cron parsing #47 → scenario 100: behavior proof running the real wfctl ci generate --platform jenkins|circleci — 22/22 assertions (secret wiring, wfctl migrations up, smoke, plan-guard; absence of the retired legacy stages).

Acceptance met: both wfctl ci generate --platform jenkins/circleci (golden tests + scenario) and step.ci_generate (plugin integration test) produce config-derived output; the jenkins/circleci template generators are removed.

Follow-up filed: the GitLab renderer lacks the plan-guard + scoped-secret handling that GHA (and now Jenkins/CircleCI) implement — tracked separately for parity.