test: pin the .cspell.yml word and ignorePaths contract

[hivecommons-hive]

Test Improvement

Adds tests/cspell-config.test.mjs, the first test that reads inside
.cspell.yml, and removes the fifteen words: entries it proves are
unreachable.

tests/workflow-scripts.test.mjs:201 already checks that check:spelling
points at a path that exists. Nothing checked what that path contains, so the
allowlist governing npm run check:spelling had no contract.

The defect this removes

cspell matches words case-insensitively unless caseSensitive: true is set,
and .cspell.yml does not set it. These fifteen entries differ from another
entry only by case, so none of them can ever be the entry that allows a word:

Docusaurus Kubestellar CNCF Cartografos Prettier Bootc Kserve Kubeflow
Kubevirt Kyverno Organisation Rollouts Runbooks SNSSAI Telco

Case-insensitivity was verified against this repo's own cspell rather than
taken from the docs, in both directions:

words: [zzqwerty]  vs  text "Zzqwerty ZZQWERTY zzqwerty"  -> 0 issues
words: [Zzqwerty]  vs  text "zzqwerty"                    -> 0 issues

What the test pins

• version is the string '0.2' and language is en. The YAML quoting is
  what stops 0.2 parsing as a number, which cspell rejects.
• No words entry collides with an earlier one under toLowerCase(). The same
  test asserts caseSensitive is still unset, so opting into case sensitivity
  later fails this test and forces the guard to be reconsidered rather than
  silently inverted.
• dictionaries includes en_US. Without it, ordinary English has to be listed
  by hand and words: stops being project vocabulary.
• ignorePaths still covers node_modules/**, build/**, package-lock.json,
  **/*.svg and **/*.json — machine-written files whose failures no
  contributor can act on except by growing words:.
• A negative case proving the redundancy helper reports a synthetic collision
  and stays silent on a genuinely distinct pair, so a green run is the config
  answering rather than the helper matching nothing.

Verification

• npm run check:spelling — Files checked: 43, Issues found: 0 in 0 files,
  unchanged from main 6ccdaac with all fifteen entries removed.
• TZ=UTC node --test tests/cspell-config.test.mjs — 6 pass, 0 fail.
• Reintroducing - Kyverno makes the guard fail, naming both sides of the
  collision.
• npm run test:unit:coverage:check — exit 0; the new file reports
  100.00% lines / 100.00% regions.
• npx prettier --check — clean on both changed files.

Scope

No production code and no workflow files. Disjoint from every open hold-gated
PR: #1004 (tests/ignore-file-contract.test.mjs), #1007
(.markdown-link-check.json), #1010 (tests/markdownlint-config.test.mjs),
#998, #1000, #1002, #996, #989 and #991 touch no overlapping path, and none of
them reads .cspell.yml.

Related Issue

Closes #1011 — merging this leaves nothing for the issue to track: both
deliverables (the removals and the guard) land here.

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.