Derive CI planner gate test inputs from package.json scripts

[Rangsh]

Derive CI planner gate test inputs from package.json scripts

Stop hand-maintaining scripts/*.test.mjs paths in RELEASE_CONTRACT_FILES and ASF_SOURCE_FILES. The planner now reads check:release and check:asf-source (including nested npm run delegations) and treats each named test file as an input to that gate's lane.

Summary

Whether a scripts/*.test.mjs file runs, and whether a change to it schedules the lane that runs it, were previously written in three places: the test file itself, an npm gate script (check:release, check:asf-source) or a CI step, and a literal path list in scripts/ci-test-plan.mjs. Missing the third meant the gate still ran the test, but editing the test alone did not select the lane — so the test could be changed green without CI exercising it.

This PR makes the planner derive those test-file inputs from package.json instead:

• loadGateTestFiles() reads check:release and check:asf-source
• collectGateScriptTestFiles() extracts every scripts/*.test.mjs path from each gate script's command text
• Nested npm run invocations are followed recursively (e.g. check:release → check:asf-npm → scripts/asf-npm-workflow-policy.test.mjs)
• isReleaseContractPath() and isAsfSourcePath() union the derived sets with the remaining static authority paths

Thirteen hand-written .test.mjs entries are removed from RELEASE_CONTRACT_FILES and ASF_SOURCE_FILES. Static non-test authority paths (workflows, generators, manifests) stay listed as before.

Out of scope (per issue): the ~11 test files named directly in .github/workflows/ci.yml node --test steps are unchanged — most run unconditionally and need no lane selection. App icon drift tests remain driven by the workflow step, not an npm gate script.

Fixes #4473

Verification

node --test scripts/ci-test-plan.test.mjs

Result: 32/32 tests passed.

Spot checks:

node -e "import { planTests } from './scripts/ci-test-plan.mjs'; const p = planTests(['scripts/desktop-nightly-workflow-policy.test.mjs']); console.log(p);"
# releaseContract: true (previously missed by the static list)

node -e "import { planTests } from './scripts/ci-test-plan.mjs'; const p = planTests(['scripts/source-legal-inventory.test.mjs']); console.log(p);"
# releaseContract: true, asfSource: true (shared across both gates)

Not run locally: full npm ci, check:release, check:asf-source, or workflow-policy suites. The change is confined to the install-free planner and its unit tests, which run before npm ci in CI.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope:

Cursor (Auto) — implemented loadGateTestFiles / collectGateScriptTestFiles, removed duplicated static test paths, and updated ci-test-plan.test.mjs guardrails.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

Behavior change: editing any scripts/*.test.mjs named by check:release or check:asf-source (including via nested npm run) now selects release_contract or asf_source in the CI test plan. Previously, several release-gate tests (e.g. desktop-nightly-workflow-policy.test.mjs, release-cli-* tests reachable only via derivation) did not select their lane when edited alone. The planner's output now also depends on package.json script text, not only the static tables.