chore(repo): retire the repository-local gates for distributable enforcers

[systemfsoftware-maker]

No scripts/guards/* remains, and no script under scripts/tools/ gates a change. Each invariant the gates held is now enforced by something this repository already locks in its flake (actionlint from nixpkgs, version-management sync check from the pnpm-release-management release tools), by Cargo's manifest semantics, by a real test of the product, or by the release tooling's real effect. Otherwise it is dropped, with the reason in the map below. No enforcer decides by a name, word or regex match.

Plan: docs/plans/2026-10-09-1313-refactor-distributable-guards-plan.md. Lesson: docs/solutions/integration-issues/version-surfaces-declared-not-rechecked.md.

Old gate → new enforcer → CI job

Old gate	Invariant	New enforcer, or why dropped	CI job
scripts/guards/check-remote-master.ts (pre-push)	A pushed branch contains remote master	Dropped. A client-side hook held it only where it was installed and not skipped. pull_request CI tests GitHub's merge ref, which already contains master. Requiring up-to-date branches is a ruleset setting only the operator can turn on	—
check-dep-pins.ts (lockfile)	Lock resolves @types/node only at 24.x	Dropped. pnpm-workspace.yaml overrides ('@types/node': ^24.19.1) and the launcher specifier are the declarations; --frozen-lockfile refuses a lock that disagrees. The check compared against a 24 written inside the checker	—
check-dep-pins.ts (Dependabot)	Launcher entry ignores typescript / @types/node majors	Dropped. dependabot.yml is the declaration Dependabot reads; checking that the file contains its own lines is a text match	—
check-versions.ts	Every version surface equals the released version	version-management sync check (locked toolchain). release.jsonc now declares Cargo.toml as a cargo surface (workspace version, pinned members, Cargo.lock) and .claude-plugin/plugin.json as a json surface	CI / actionlint + version surfaces
check-versions.ts (crate) + run-binary-smoke.ts (identity)	The built binary reports the released version	The crate inherits version.workspace = true, and a re-pinned member counts as drift for sync check. The nix job builds from the flake and requires --version == claude-code-comment-checker <package.json version>	CI / nix flake check, CI / actionlint + version surfaces
run-binary-smoke.ts (exit contract)	Clean exits 0, flagged exits 2	crates/comment-checker/tests/exit_codes.rs runs the built binary	CI / gate
run-binary-smoke.ts (per platform)	Each release binary passes the smoke on its runner	Dropped. Its only caller, platform.yml release mode, has no caller; the shipped binary is the flake's source build	—
lint-workflows.ts	Workflows are valid Actions, runner labels included	actionlint from the flake's locked nixpkgs (also in the devShell)	CI / actionlint + version surfaces
lint-workflows.ts (file mode)	Workflow files world-readable	Dropped. Only the wrapper's container bind mount needed it	—
check-matrix.ts (rows ⊆ table)	Every platform.yml row names a targets.json target/suffix/bin	Real effect: stage-platform-package.ts exits 1 on an unknown pair; bundle-release-tarball.ts fails when the table's bin is not the built file	CI / packaging
check-matrix.ts (table ⊆ rows)	Every table row has a workflow row	Dropped. Nothing iterates the whole table any more, so an unbuilt row has no effect	—
check-matrix.ts (runners)	Table runner equals workflow runner, known label	Dropped. The table's runner has no reader; workflow labels are checked by actionlint	—
check-matrix.ts (suffix set)	Table names exactly three suffixes	Dropped. Compared the table to a list written in the checker	—
check-matrix.ts (package shape)	suffix = os-cpu, libc only on Linux, .exe iff win32	Dropped. Shapes npm platform packages, which are no longer published or packed	—
check-matrix.ts (launcher pins)	Launcher optionalDependencies equal platform packages	Dropped. The launcher declares no optionalDependencies	—
check-matrix.ts (caller)	ci.yml calls platform.yml	Dropped. A text match over a workflow; the packaging jobs show on every PR	—
verify-platform-metadata.ts	Published platform packages carry table metadata	Dropped. No caller; nothing is published to a registry	—
tools.yml	Shebang tools execute on Windows	packaging / rehearsal · win32-x64 runs stage-platform-package.ts and bundle-release-tarball.ts on windows-2022	CI / packaging

master requires no status checks, so each enforcer above is a red CI job, not a merge block. Making the jobs required is a ruleset change only the operator can make.

Each kept enforcer red on one honest violation

Violation commit a4b1e6a, CI run 37935471723, reverted by 4047edd:

• actionlint + version surfaces: .github/workflows/js-gate.yml:30:24: property "nope" is not defined in object type {}, then Cargo.toml 0.3.7 != package.json 0.3.6 and .claude-plugin/plugin.json 0.3.7 != package.json 0.3.6
• nix flake check: nix-built binary reports 'claude-code-comment-checker 0.3.7', expected 'claude-code-comment-checker 0.3.6'
• gate: flagged_payload_exits_with_the_blocked_contract ... FAILED (blocked payload exited 1)
• packaging / rehearsal · windows-x64: target x86_64-pc-windows-msvc / suffix windows-x64 missing from targets.json, exit 1, on windows-2022

The head is green on every job (below).

Removed

scripts/guards/, check-dep-pins.ts, check-matrix.ts, check-versions.ts, lint-workflows.ts, run-binary-smoke.ts, verify-platform-metadata.ts, scripts/lib/{matrix-rows,version-files,version-sync}.ts, .husky/ with husky and prepare, tools.yml, and the gate tasks, imports and path constants that only the gates used. The release tooling (stage-platform-package.ts, bundle-release-tarball.ts, generate-platform-manifest.ts and their scripts/lib/ modules) stays.

[kiro-systemf]

Conductor verdict: 9/9 green on a3800b3; every kept enforcer red in run 37935471723 on violation a4b1e6a, reverted in 4047edd; all review findings disposed; docs/solutions lesson present; signed; no private names.