fix(desktop): harden the renderer architecture ratchet base comparison

[chihumyum]

Summary

Three follow-ups to #4249's base-tree ratchet, so the guard fails loudly and cannot be lowered from one side.

• --strict-base: when the base commit's tree cannot be materialized or analyzed, the check fails instead of silently falling back to the base's committed ledger (the pre-fix(desktop): ratchet renderer debt against the base tree, not its ledger #4249 behavior that wedged CI in CI red on main: "Check renderer architecture" fails from a stale renderer-architecture ledger #4250). CI now passes the flag; local runs without it are unchanged.
• Cross-check under the base commit's checker: when check-renderer-architecture.mjs itself differs from the base commit, the base version is imported and its generateArchitectureConfig is run over both trees, and the current validateMonotonicDebt compares the two. Debt that the base rules would have flagged fails as a base-checker cross-check: violation, so one PR cannot weaken a rule and lower both sides of the ratchet at once. Nothing extra runs when the script is unchanged.
• Git-fixture tests for the base-tree derivation, which fix(desktop): ratchet renderer debt against the base tree, not its ledger #4249 shipped without: equal-or-lower debt passes, a new unclassified legacy file fails, a base ledger that under-reports its own tree (CI red on main: "Check renderer architecture" fails from a stale renderer-architecture ledger #4250) no longer wedges, --strict-base fails when the base cannot be materialized, and the cross-check catches a weakened checker.

Refs #4582

Verification

• node --test apps/desktop/scripts/check-renderer-architecture.test.mjs — 78 tests (71 existing + 7 new), 0 failures
• npm run check:renderer-architecture -- --base upstream/main — passes; because this PR changes the script, the output shows the cross-check running (… differs from upstream/main; cross-checked debt under the base checker.)
• npm run check:renderer-architecture (no base) — passes
• Workflow policy tests (scripts/*workflow-policy*.test.mjs) — 69 tests, 0 failures
• npm run check:asf-headers, Biome lint on both scripts, git diff --check — clean
• renderer-architecture.json is untouched. Run under Node 24 (identical under Node 22).

Review focus

• Strict-mode policy: under --strict-base, a base checker that exists but cannot be imported, or whose generator throws on either tree, fails closed; a base checker with no generateArchitectureConfig export, or whose output does not fit the current ledger schema, is a notice-and-skip in both modes. Consequence: a PR that makes the old checker unable to analyze the new tree must land the checker change first. Easy to flip if the other default is preferred.
• The cross-check protects the measurement. A PR that weakens validateMonotonicDebt itself is not covered; that stays a review concern.
• The scratch copy of the base checker is written next to the live script so @babel/parser resolves, and removed in finally; .gitignore covers a crash mid-run.
• Surfaced but left alone: the script's import.meta.url === pathToFileURL(argv[1]) guard is realpath-sensitive, so invoking it through a symlinked path is a silent no-op. The fixtures use realpath.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code — implementation, tests, and local validation. The commit carries a Generated-by: Claude Code trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above: CI fails instead of warning when the base tree cannot be derived, and a PR that weakens the checker while adding debt is rejected.
• No

[chihumyum]

The first CI run failed only in Storybook smoke, on the provider-settings.stories play; every other step passed. This PR changes only the architecture checker script, its tests, the CI step that invokes it, .gitignore, and the renderer README, so it cannot reach that story. Rebased onto current main (9225f80b0) to re-run CI; exact head 54bc30f0fde28541c4d7db2ebb123d39901a7e0f. The checker fixture suite (78/78) and check:renderer-architecture --base upstream/main (with the cross-check exercised, since the script differs from main) pass locally on this head.

Automated update from Claude Code on behalf of the PR author.