test: pin the .vscode/settings.json exclude contract

[hivecommons-hive]

Test Improvement

.vscode/settings.json was the last developer-environment entry point with no
test reading it, and it had drifted in both directions at once.

What it excluded, none of which exists here. .docker/, vendor,
/resources and /themes/docsy are the layout of the Hugo + Docsy site that
preceded this one. All four are absent from the checkout, so VS Code silently
discarded every one of them. The fifth, "**/.vscode": true in files.exclude,
hid the settings file from the explorer — which is how it stayed wrong.

What it did not exclude. Every directory the repo writes and .gitignore
ignores — build/, .docusaurus, coverage, test-results,
playwright-report — appeared in none of the three maps. After the build and
e2e commands CONTRIBUTING tells a contributor to run, VS Code search returned
hits out of the generated bundle and the Playwright report, and the watcher
walked both trees.

Changes

.vscode/settings.json — rewritten to exclude what this repo actually
produces.

tests/dev-environment.test.mjs — extended rather than duplicated: this file
already owns Justfile and .devcontainer/devcontainer.json for exactly this
reason, and already has the stripJsonComments() and git check-ignore
machinery the new assertions need. Four tests:

1. no excluded path is fiction — every literal key across the three maps
   must exist in the checkout or be gitignored;
2. every generated directory is excluded from search.exclude and
   files.watcherExclude;
3. every directory the suite requires excluded is gitignored — so rule 2
   can never demand that tracked files be hidden;
4. files.exclude does not hide .vscode.

Tests 1, 2 and 4 each fail against the previous file and pass against the new
one; verified by stashing the config change and re-running:

✖ every path .vscode/settings.json excludes exists or is gitignored
✖ .vscode/settings.json excludes every directory the repo generates
✖ files.exclude does not hide .vscode from the explorer

.gitignore — one line. Test 1 caught **/.DS_Store being watcher-excluded
but never gitignored, which is a real gap for anyone on macOS. Adding it is
what makes the invariant hold without carving an exception into the test.

Note on the git check-ignore probe

.gitignore:10 is /build/. A directory-only rule does not match the bare
pathname build, and a file rule such as .DS_Store does not match
.DS_Store/ — check-ignore matches rules against the pathname's shape, not
against the filesystem. The helper therefore probes both forms.

Verification

• TZ=UTC node --test tests/dev-environment.test.mjs — 16/16 pass
• TZ=UTC node --test — 1786 tests, 0 fail
• npm run test:unit:coverage:check — exit 0 (--check 99 --check-source 100 --check-regions 94 --check-source-regions 99)
• npx prettier --check on every changed file — clean

Scope / overlap

Touches .vscode/settings.json, tests/dev-environment.test.mjs and
.gitignore. Disjoint from every open hold-gated PR: #1004 reads
.prettierignore/.markdownlintignore in a new
tests/ignore-file-contract.test.mjs and asserts nothing about .gitignore or
.vscode; #1007, #1010, #1012, #1014, #996, #989, #991, #998, #1000 and #1002
touch none of these three files. Branch cut from origin/main at 6ccdaac.

Related Issue

Closes #1015

---

Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.