test(static-references): exercise every static-asset detection path

[hivecommons-hive]

Test Improvement

tests/static-assets.test.mjs asserted six static-asset contracts — existence,
non-emptiness, exact-case naming, path traversal, and <CNCFProjectCard logo>
resolution — but never exercised the branches that report a violation. At
main @ b54cf81 the file measured 89.06% lines / 85.71% regions, and every
uncovered region was a detection path: describe(), and the missing,
not-a-file, zero-byte, case-mismatch, traversal and broken-logo push sites.

Its only guard against going vacuous was REFERENCES.size > 20. That catches a
scan that finds nothing; it does not catch a stripUrls()/staticReferences()
change that keeps finding references while quietly dropping the broken ones, or
a checker whose comparison stops flagging them. The suite would stay green and
the site would ship a broken image.

This PR:

• adds tests/tools/static-references.mjs — the scan plus the five checkers,
  parameterised by root, moved verbatim so behaviour is unchanged;
• rewrites tests/static-assets.test.mjs to assert the same six contracts
  through that module against the real repository, with identical assertions
  and identical failure messages;
• adds tests/static-references.test.mjs: 17 cases driving each checker
  against fixture trees that really do contain a missing, not-a-file,
  zero-byte, case-mismatched (leaf and intermediate directory), escaping and
  unresolvable-logo reference — plus the negative cases (remote URL, bare
  top-level directory, exact-case match) that prove the checkers do not
  over-report.

No production code is touched.

Evidence

file	before	after
tests/static-assets.test.mjs	89.06% lines / 85.71% regions	100.00% / 100.00%
tests/static-references.test.mjs	—	100.00% / 100.00%
tests/tools/static-references.mjs	—	100.00% / 100.00%
all files	99.09% lines / 93.34% regions	99.18% / 93.58%

TZ=UTC node --test — 1197 pass, 0 fail, 2 todo.
TZ=UTC node tests/tools/coverage-report.mjs --check 97 --check-source 99 — exit 0.

Related Issue

Closes #734

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.

[mrbobbytables]

Superseded by #750, which consolidates this and 14 other test-only coverage PRs into a single reviewable change (commit cherry-picked unmodified, authorship and DCO preserved).