fix(test): make the harness resolve the keeper module so lint covers it

[xepozz]

What was changed

• keeper/test/wippy.lock selects keeper/keeper again, so the harness turns the local replacement into a module load path.
• The replacement moves from the lock to workspace.replacements in a tracked keeper/test/.wippy.yaml.
• Root .gitignore exempts that one file.

Why?

make lint-keeper printed this, and had been printing it for weeks:

No issues found
Checked 4 entries

The four are the harness's own keeper.hub.security entries. None of keeper's ~380 were linted. A deliberate syntax error in keeper/src/keeper/agents/tools/delegate.lua went unreported; --ns keeper.agents.tools matched zero entries.

The lock carried a replacement for a module it did not select:

modules:
    - name: userspace/contract
      ...
replacements:
    - from: keeper/keeper
      to: ..

GetModuleLoadPaths skips a replacement whose module is not in the selection (boot/deps/lock/lock.go):

for _, repl := range replacements {
    if _, selected := selectedVersions[repl.From]; !selected {
        continue
    }

So the module never became a load path, and every load-path command — wippy lint among them — saw nothing. wippy test was unaffected: it resolves the ns.dependency in test/_index.yaml through the hub dependency handler, a different path. That is why the gap stayed invisible while the suites kept passing.

The module entry was dropped in ccc81cd (fix(packaging): keep Keeper tests out of production, 2026-07-15), which rewrote the lock and removed keeper/keeper along with stale versions. Lint has been green on nothing since.

The replacement also moves to workspace.replacements, the form the runtime already asks for on every invocation:

WARNING: DEPRECATED replacements in keeper/test/wippy.lock
Move them to workspace.replacements in a runtime config file; lock-file replacement support will be removed.

That config file is .wippy.yaml, which the root .gitignore excludes so developers can keep local overrides. wippy/dataflow's harness tracks its own test/.wippy.yaml for exactly this, so this follows that shape and exempts the single path.

One constraint worth knowing: the selected version has to equal keeper/wippy.yaml's, or hub resolution fails with manifest version mismatch for keeper/keeper: requested 0.0.0, hub returned 0.5.79. A release bump must move both. 0.0.0 works in dataflow only because its replacement points at a directory with no manifest. The failure here is loud, immediate and names the fix.

Checklist

• Closes #

• Tested

  • Tested manually
  • Unit tests added

• make lint-keeper: 384 entries, 4 warnings, 0 errors — was 4 entries. All four warnings are the pre-existing inter-function fixpoint did not converge analyzer notice.

• Coverage probed, not assumed: a syntax error appended to delegate.lua is now reported (Checked 384 entries: 1 errors), with a warm cache, through the exact Makefile invocation. Before this change the same probe reported nothing.

• keeper.hub:test 126/126, keeper.agents.tools:test 64/64, keeper.internal.flow:repo_test 11/11.

• The lock-replacement deprecation warning no longer prints.

Remaining gap, not addressed here: exclude_meta.type: [test] in keeper/wippy.yaml keeps test entries out of the registry, so *_test.lua is still unlinted. test.sh strips that block for the duration of a run; wiring the same for lint means sharing that surgery between the two, which is its own change.