test: guard READ_ONLY_VALIDATORS against scripts/validate-*.mjs (tests/validator-smoke-coverage.test.mjs)

[hivecommons-hive]

Test Improvement

Adds tests/validator-smoke-coverage.test.mjs — a guard over the
READ_ONLY_VALIDATORS array in tests/validators-smoke.test.mjs.

Files/functions/cluster claimed by this PR: tests/validator-smoke-coverage.test.mjs
(new file, the only file changed). It reads tests/validators-smoke.test.mjs
and scripts/validate-*.mjs; it modifies neither.

Why this array matters

.github/workflows/ci.yml is the only pull_request-triggered workflow, and
its steps are npm ci, npm run test:unit, npm run build:production. It
never invokes npm run validate:*. The four data validators run directly only
in deploy-gh-pages.yml (push to main) and import-architectures.yml
(schedule) — both post-merge.

So the validators gate a pull request exclusively through
validators-smoke.test.mjs, which executes each listed script against real
repository data. A validator added to scripts/ but forgotten in the array
runs on no pull request; its first failure lands post-merge on the deploy,
blocking an already-merged change.

Nothing keeps the list in sync — it is a literal list of strings, so adding
scripts/validate-foo.mjs leaves every existing test green.

What the test asserts

1. The repository still ships read-only validate-*.mjs scripts (so the guard
   cannot pass vacuously).
2. Every read-only validator on disk appears in READ_ONLY_VALIDATORS.
3. Every entry in READ_ONLY_VALIDATORS exists in scripts/.
4. No entry is listed twice.

"Read-only" is derived from the script source (no fetch/write/spawn call)
rather than hard-coded, so the guard does not go stale when a validator gains a
write mode. validate-architecture-assets.mjs has a --fix path and is
therefore not required to be listed; it is listed today and that stays valid.

Verification (clean checkout at 00b44df, node v26.8.1)

• New file: 4/4 pass. Full suite: 59/59 pass (was 55).
• Regression check: dropping a read-only scripts/validate-foo.mjs into the
  tree fails assertion 2 with actual: [ 'validate-foo.mjs' ].
• prettier --check clean.

Disjointness from open PRs

• test: cover the package.json script and CI command wiring contract #278 tests/workflow-scripts.test.mjs — asserts npm run targets named in
  workflows/package.json resolve to defined scripts and existing files. It
  does not read validators-smoke.test.mjs and does not model which validators
  execute on a pull request.
• test: assert CI action pinning and token-permission contract (tests/ci-supply-chain.test.mjs) #301 tests/ci-supply-chain.test.mjs — action pinning and token permissions.
• [quality] test: report coverage of fixture-sandbox runs (tests/tools/coverage-report.mjs) #225 package.json, tests/tools/coverage-report.mjs — coverage reporting
  for fixture-sandbox runs.
• [quality] test: cover validate-architecture-assets.mjs --fix write mode (tests/helpers.mjs args/readBack + tests/validate-architecture-assets.test.mjs) #231 tests/helpers.mjs, tests/validate-architecture-assets.test.mjs;
  test(metrics): cover validate-metrics optional-section branches #263 tests/validate-metrics.test.mjs; [quality] test: cover scripts/lib/validate-utils.mjs error and warning paths #185 tests/validate-utils.test.mjs —
  different test files, different validators' internals.
• No open PR touches tests/validators-smoke.test.mjs or adds a file under
  this name.

No production files are changed.

Related Issue

Closes #365

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.