test: exclude generated website output from writer scans

[leehack]

Summary

Fixes #487. Prune generated build, Docusaurus, dependency and cache directories before traversing writer-contract sources. Previously, a concurrent website build could remove a generated JavaScript bundle after the scan listed it, or bundled third-party code could trigger a false positive.

The executable/task and Markdown scans share this traversal. Maintained workflows, writer tools, website source and task files retain the existing forbidden-writer checks; maintained read errors still propagate.

Production-readiness scope

• Runtime behavior, public APIs, platform support and production pins are unchanged.
• Scope is repository validation only. No runtime changelog entry or API documentation change is needed.
• Follow-ups: None.

Regression coverage

• Positive ownership fixtures retain workflows, Dart tools, shell scripts, website TypeScript, package.json and Makefiles, including Windows path separators and build_tools names.
• Negative fixtures exclude nested website/build, website/.docusaurus, app build, dependency and cache sources.
• Filesystem fixtures contain invalid UTF-8 generated bundles, proving they are never read; maintained writer content remains visible and invalid UTF-8 in a maintained source still throws.

Test Plan

Using Flutter 3.47.1 / Dart 3.13.1:

• Workspace preparation (no tracked dependency changes).
• Root format check and dart analyze.
• Targeted safe_pr_head_update suite: 33 passed.
• Full serial VM: 2,055 passed, 77 skipped.
• Full Chrome: 925 passed.
• Docs build and link validation.
• Release docs version verification.
• Post-doc writer suite: 33 passed with generated website output present.
• Real-model/device validation: N/A for test-only ownership filtering; the full suites retain their normal integration coverage.

Review Notes

Draft only. Independent Astra-high review accepted the final candidate; final-head CI passed. This is not a mark-ready request.

High-risk regression review

• Classification: high-risk (regressionPolicy), from repository classifier.
• Implementation task: issue Exclude generated website output from maintained writer source scan #487 implementation in coordinating next-release task.
• Independent blocking QA task: accepted by codex-adversarial-writer493-final, session 01a08638-bcde-7fd2-b9b4-0cd65ea0f82e; launcher verified gpt-6-astra / high.
• Exact head / current base: e64cfb0777b54a48a7a1facfd07e52abbf985a77 / ecaa1233282f9dfdb7e2952e60c6e4281ea10e4d.
• Production-branch deletion, bypass, or miswire proof: replacing the pre-descent pruning guard with if (true) fails the direct traversal fixture (8 entries instead of 5). Auditor verified the supplied mutation failure, scanner consumers, and all 474 tracked writer sources.
• Affected-family real-model/artifact evidence: N/A; no runtime behavior changes.
• Explicit unavailable-family or other N/A evidence: hardware/model qualification is outside this scan-only fix.
• Known PR-caused P1 regressions: 0; independent final audit accepted with no blocking findings.
• Unresolved review threads: 0 (live GraphQL query after creation).

Independent QA follow-up

The first Astra-high audit requested a traversal-level regression assertion (P2, no implementation defect/P1). The revised head adds that assertion before writer-path filtering. An actual mutation replacing the pre-descent pruning guard with if (true) fails with all three generated fixture paths exposed (8 entries instead of 5); the guard was restored afterward.

At revised head e64cfb0777b54a48a7a1facfd07e52abbf985a77, all 33 affected tests pass with generated docs present, root analysis reports no issues, root formatting reports 591 files unchanged, and diff checks pass. The broader VM/Chrome/docs results above were run at the preceding implementation head; current-head CI passed; fresh independent Astra-high QA accepted the exact revised head. The follow-up changes only six lines of regression assertions. No mark-ready approval is requested.

Final independent evidence

Auditor independently reran all 33 affected tests, targeted analysis, formatting, high-risk classification and diff checks, and verified the exact head/base plus zero unresolved threads. No blocking findings remain. Full CI run 34353399872 completed successfully on the exact revised head; advisory run 34353397347 passed.

The repository readiness evaluator reports unverifiedPrerequisites (documented exit 2): the local evidence is internally consistent, but dedicated GitHub App publication, authenticated auditor boundary, protected-environment provenance and conditional ruleset enforcement are unavailable. This is not an operational merge-readiness attestation. No settings changes or mark-ready action were performed.

Final CI verification

CI run 34353399872 completed successfully at e64cfb0777b54a48a7a1facfd07e52abbf985a77: Linux VM/coverage and aggregate, macOS/Windows native tests, Chrome, both companion packages, native prompt parity, docs, analysis, and Web Chat Contract all passed. Advisory also passed. Final live GraphQL confirms the audited head/base, draft state and zero unresolved review threads. No mark-ready, merge or settings change was performed.