chore: drop dead e2e fixtures, fix stale comments, and pin the merge-scenario timeouts

[Vivswan]

Before

• test/e2e/fixtures/ held 14 JSON files; 12 were imported by nothing (grep -rn fixtures test .github/scripts finds only org.json and repo.json, both loaded by test/e2e/mock/state.ts).
• Comments in nightly.yml, test/package-pins.test.ts, and _typos.toml described a dependabot-bun-lockfile.yml workflow that exists nowhere and unit tests under src/sections/*/ that moved to test/ in refactor(test): move tests, mocks, generators, scenarios, and docs prose out of src #400.
• Four of the five 300-seed genMergeScenario batteries ran on bun's 5 s default timeout; only the fifth carried 20_000. The heaviest validates 150+ merged documents and has flaked on a loaded runner.

After

• The 12 dead fixtures are gone; the two live ones stay.
• Each comment credits the from-scratch resolve to the only place it happens: nightly's float-canary, which deletes bun.lock and re-resolves. Dependabot's Bun updater keeps the checked-in lockfile and moves only the bumped dependency, so no comment says a bump regenerates it.
• One MERGE_TIMEOUT = 20_000 covers all five batteries.

How

• Dead fixtures: git rm of the 12 unreferenced files. Nothing imports them by path or by basename, and git log -S finds no loader ever committed. knip does not see JSON imports, so the grep below is the proof.
• nightly.yml comments: the file header, the float-canary header, and the "delete before resolving" step describe the from-scratch resolve directly instead of a workflow that does not exist.
• package-pins.test.ts rationale: states what the test actually guards. A from-scratch resolve honors every range in package.json, so exact pins leave only transitive ranges to float; the zod incident is dated to when a lockfile-regenerating workflow still existed.
• _typos.toml comment: "unit tests under test/".
• Timeouts: the constant sits beside SEEDS inside the describe, with the rationale comment moved from the one test that had it. biome reflows a test(title, fn, timeout) call whose title overflows the line onto three lines, which reindents the five bodies; whitespace-insensitive the file is +32/-11.

Proof

Red-then-green does not apply: the change is comments, file deletions, and a timeout. Local, targeted:

grep -rn 'e2e/fixtures\|\./fixtures/\|\.\./fixtures/' test .github/scripts src package.json | grep -v test/fixtures
  -> test/e2e/mock/state.ts:32  import orgFixture from "../fixtures/org.json"
  -> test/e2e/mock/state.ts:33  import repoFixture from "../fixtures/repo.json"
grep -rnE '(actions-permissions|...|workflow)\.json' --include='*.ts' --include='*.json' --include='*.yml' --include='*.toml' .
  -> no matches
env -u NODE_OPTIONS bun run typecheck   -> clean
bun run knip                            -> clean
bun run lint                            -> Checked 475 files. No fixes applied.
typos                                   -> clean
bun run lint:yaml                       -> clean
git merge-tree --write-tree origin/main HEAD -> clean
bun test test/e2e/generators.test.ts test/package-pins.test.ts test/e2e/mock/state.test.ts --timeout 120000
  -> 139 pass, 0 fail

Line accounting

File	+	-
.github/workflows/nightly.yml	14	13
_typos.toml	1	1
test/e2e/fixtures/*.json (12 files)	0	324
test/e2e/generators.test.ts	119	98
test/package-pins.test.ts	3	3
Total	137	439

Reviewer note

.github/workflows/auto-fix.yml carries the other two dependabot-bun-lockfile comment lines and is left untouched here: #403 and #405 edit that file, so its two lines go in a follow-up once they land.

BEGIN_COMMIT_OVERRIDE
chore: drop dead e2e fixtures, fix stale comments, and pin the merge-scenario timeouts

Twelve of the fourteen JSON files under test/e2e/fixtures are imported by nothing; only org.json and repo.json feed the mock state, so the other twelve go.
Four comments named a dependabot-bun-lockfile workflow that exists nowhere; the ones in nightly.yml and package-pins.test.ts now credit the from-scratch resolve to nightly's float-canary, the only one in this repository.
The _typos.toml glob comment still placed unit tests under src/sections; they all live under test/ now.
The four 300-seed genMergeScenario batteries ran on bun's 5 s default while their sibling had 20 s; one MERGE_TIMEOUT constant now covers all five, and biome reflows the widened calls.
END_COMMIT_OVERRIDE

[github-actions]

File size check

0 over a hard cap (fails), 30 warning(s).

File	Size	Tier	Cap
.github/scripts/release-pipeline.ts:6	156 chars	warn	150
.github/scripts/release-pipeline.ts:453	151 chars	warn	150
.github/scripts/release-pipeline.ts:1247	153 chars	warn	150
.github/scripts/release-pipeline.ts:1	34 comment lines (header)	warn	25
.github/scripts/release-pipeline.ts:449	14 comment lines	warn	10
.github/workflows/post-green.yml:29	153 chars	warn	150
.github/workflows/update-release-pr.yml:109	14 comment lines	warn	10
docs/upgrading/v2-to-v3.md	1276 lines	warn	1040
src/engine/layers.ts:217	157 chars	warn	150
src/flows/settings-write.ts:142	159 chars	warn	150
src/flows/settings-write.ts:30	11 comment lines	warn	10
src/flows/snapshot.ts:189	13 comment lines	warn	10
src/github/secret-scan.ts:42	11 comment lines	warn	10
src/schema.ts:186	153 chars	warn	150
src/schema.ts:197	176 chars	warn	150
src/sections/contract/errors.ts:14	14 comment lines	warn	10
src/sections/contract/module.ts:963	185 chars	warn	150
src/sections/contract/module.ts:627	12 comment lines	warn	10
src/sections/contract/module.ts:897	12 comment lines	warn	10
src/sections/secret_scanning_custom_patterns/compilable-form.ts:382	161 chars	warn	150
src/sections/shared/roles.ts:43	13 comment lines	warn	10
src/types.ts:16	156 chars	warn	150
test/docs/guides.test.ts:451	155 chars	warn	150
test/e2e/generators.ts	2633 lines	warn	2560
test/e2e/generators.ts:1703	166 chars	warn	150
test/e2e/generators.ts:1857	161 chars	warn	150
test/e2e/generators.ts:1666	12 comment lines	warn	10
test/engine/execute.test.ts:617	152 chars	warn	150
test/flows/merge-parity.test.ts:63	164 chars	warn	150
test/scripts/auto-fix-allowlist.test.ts:8	12 comment lines	warn	10

Split the file, wrap the line, shorten or exempt the comment, or list the path in .file-size-allow.local with a # reason.

5 managed file(s) skipped; repo-platform owns them.

[Copilot]

Copilot review overview

🟡 Changes recommended

The nightly workflow header still references the nonexistent Dependabot lockfile workflow that this PR intends to remove.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Update stale Dependabot lockfile-workflow description · New

What changed in this PR

Removes unused e2e fixtures, corrects stale maintenance comments, and stabilizes merge-generator tests.

Changes:

• Deletes 12 unreferenced JSON fixtures.
• Applies a shared 20-second timeout to five merge-scenario test batteries.
• Updates comments about dependency resolution and test locations.

File	Description
.github/​workflows/​nightly.yml	Revises float-canary commentary.
_typos.toml	Corrects the unit-test location comment.
test/​package-pins.test.ts	Clarifies exact dependency-pin rationale.
test/​e2e/​generators.test.ts	Shares an explicit timeout across merge tests.
test/​e2e/​fixtures/​actions-permissions.json	Removes an unused fixture.
test/​e2e/​fixtures/​autolink.json	Removes an unused fixture.
test/​e2e/​fixtures/​branch-protection.json	Removes an unused fixture.
test/​e2e/​fixtures/​code-scanning-default-setup.json	Removes an unused fixture.
test/​e2e/​fixtures/​collaborator.json	Removes an unused fixture.
test/​e2e/​fixtures/​environment.json	Removes an unused fixture.
test/​e2e/​fixtures/​label.json	Removes an unused fixture.
test/​e2e/​fixtures/​milestone.json	Removes an unused fixture.
test/​e2e/​fixtures/​pages.json	Removes an unused fixture.
test/​e2e/​fixtures/​ruleset.json	Removes an unused fixture.
test/​e2e/​fixtures/​team-repo.json	Removes an unused fixture.
test/​e2e/​fixtures/​workflow.json	Removes an unused fixture.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

The revised comments incorrectly describe Dependabot's targeted Bun lockfile update as a from-scratch resolution.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 2

Open (2)

• Clarify Bun update header as a broader range probe · New
• Tie exact-pin rationale to from-scratch nightly installs · New

Resolved since last review (1)

• Update stale Dependabot lockfile-workflow description

[Copilot]

Copilot review overview

🟢 Approval recommended

The deleted fixtures have no remaining references, and the comment and timeout changes are consistent and localized.

Review effort: Balanced
Findings: 2

Open (2)

• Tie exact-pin rationale to from-scratch nightly installs
• Clarify Bun update header as a broader range probe

[Copilot]

Copilot review overview

🟢 Approval recommended

The deleted fixtures have no remaining references, and the timeout and comment updates are consistent and complete.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Tie exact-pin rationale to from-scratch nightly installs
• Clarify Bun update header as a broader range probe

[Copilot]

Copilot review overview

🟢 Approval recommended

The deleted fixtures are unreferenced, and the comment and timeout changes are consistent with current behavior.

Review effort: Balanced
Findings: None