fix(ci): the audit was reporting a fraction and calling it a total

[catomean]

fix(ci): the audit was reporting a fraction and calling it a total

Kivvi has seven retired model ids. The audit reported two.

Understating a repo is worse than skipping one. A skipped repo is visibly
absent; an understated repo prints a number that reads like an answer, and the
five pins it left out were in packages/ai — Kivvi's actual provider chain.

Three independent causes, each found by chasing the previous one.

1. The AI word had to appear in the FILENAME. Kivvi keeps its provider clients
   side by side:

   packages/ai/src/providers/anthropic.ts   ← scanned
   packages/ai/src/providers/groq.ts        ← never opened
   packages/ai/src/providers/openrouter.ts  ← never opened
   packages/ai/src/providers/index.ts       ← never opened
   

   Two files in one directory, one seen and one not, decided entirely by which
   vendor names someone had typed into a regex. A directory called ai/ counted
   for nothing. Path matching now looks at every segment below the source root,
   and the vendor list is no longer four names long.

   Matching is by TOKEN, never substring: ai is inside mail, chain,
   domain, detail and maintenance, and substring matching would have
   traded one blind spot for a flood that the file cap then drops real
   candidates to make room for. Tested in both directions.

2. Opening the files was not enough — nothing came out of them. extractPins
   matched models followed directly by [, and Kivvi writes

   models: AIModel[] = [
   

   where a TypeScript type annotation sits in between. The first [ on that
   line belongs to AIModel[] and closes immediately, so the pattern read an
   empty array: a silent nothing, the worst output an audit can produce. The
   same regex also capped the array at 400 characters, losing later entries of
   any richly described list. Replaced with a bracket walker that has neither
   limit and reports each id's own line — which also improves attribution, since
   that is measured in lines from the pin.

3. The coverage ledger stopped being a caveat and became a finding: OrangeCat
   opened 90 of 133 candidates with 4 likely-AI files dropped, FleetCrown 90 of
   109 with 15 dropped. The two largest repos in the fleet, both partly blind.
   Cap raised 90 -> 160, which clears both with headroom. The ledger stays, so
   the next repo to outgrow it says so.

What the fleet actually looks like, before -> after: 12 retired pins -> 16, and
the composition changed more than the count. Newly visible:

• hirnli — 2 dead pins, a repo that had never appeared in a report at all
• orangecat:src/lib/ai/form-prefill-service.ts:23 — genuinely broken, and it
  is the repo this audit cleared as a false positive earlier today. It was
  right that the pricing-table string was not a pin, and wrong that the repo
  was fine.
• kivvi packages/ai — 5 more, including a google/gemini-2.0-flash-001 that
  no previous run had seen
• evig src/lib/hirn/providers — 2 more

Every one of them was retired before this commit. None of them was new.

Self-test: 57 -> 76 checks, still no network, no key, no checkout. The fixtures
are the real paths and the real declaration, so this specific miss cannot come
back quietly.

🤖 Generated with Claude Code