feat(#2128): phase-id anti-divergence guard — canonical token source + drift scanner + guards

Phase 4 of epic #2121 (ADR-2121 Decision 7), closing the recurrence loop that
produced #2111 / #2114 / #2104: no module outside src/phase-id.cts may
re-implement phase-ID parsing without failing CI.

- phase-id.cts: add PHASE_NUMBER_TOKEN_SOURCE — the canonical phase-number-token
  grammar (\d+[A-Z]?(?:\.\d+)*) for enumeration/scan call sites, the ANY-phase
  counterpart to phaseMarkdownRegexSource(n)'s known-number lookup. Extend-only
  (never touches normalizePhaseName; blast radius 79 fns / CRITICAL).
- scripts/lint-phase-id-drift.cjs: pure findPhaseIdRegexDrift(text) + scanRepo(root),
  wired to `npm run check:phase-id-drift`. Flags a literal re-derivation of the
  canonical token (both /\d/ and new-RegExp `\\d` escaping, plus the [A-Za-z] and
  [.-] near-variants) anywhere in src/** outside phase-id.cts, unless sanctioned
  with `// phase-id-owner: <reason>`. Narrow by design: bare \d+, digits-only
  captures, \w ids, status-message text and pipe-tables are not flagged.
- tests/phase-id-drift-guard.test.cjs: fail-first drift cases (AC1) + live
  scanRepo(ROOT) zero-drift (AC3) + identity guard — phase-id.cjs exports the
  complete locked surface and no consumer re-exports a divergent copy (AC2).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/lint-phase-id-drift.cjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Anti-divergence drift guard for the phase-identifier parsing seam
+ * (epic #2121, Phase 4 / issue #2128, locked by ADR-2121 Decision 7).
+ *
+ * `src/phase-id.cts` is the SINGLE canonical owner of phase-ID parsing. Its
+ * `PHASE_NUMBER_TOKEN_SOURCE` (and `phaseMarkdownRegexSource` for a known number)
+ * is the one place the phase-number-token grammar `\d+[A-Z]?(?:\.\d+)*` is
+ * defined. Every other module that scans/enumerates phase headings must build
+ * its regex from that source rather than re-deriving the grammar as a literal —
+ * otherwise the trio drifts again (the #2111 / #2114 / #2104 recurrence loop this
+ * epic closes).
+ *
+ * This lint makes the invariant machine-enforced: it FAILS the moment a literal
+ * re-derivation of the canonical token grammar is introduced anywhere in
+ * `src/**` outside `phase-id.cts`, unless the site is deliberately sanctioned
+ * with a `// phase-id-owner: <reason>` comment (on the same line or the line
+ * directly above). Sites that build their regex from `PHASE_NUMBER_TOKEN_SOURCE`
+ * carry no literal grammar and pass automatically.
+ *
+ * Detection is intentionally NARROW: only the contiguous canonical token
+ * (`\d+[A-Z]?(?:\.\d+)*`, its `[A-Za-z]` and `[.-]` near-variants, in both
+ * regex-literal `\d` and `new RegExp` template `\\d` escaping) is drift. Bare
+ * `\d+` probes, `[\w][\w.-]*` ids, digits-only captures, status-message text
+ * (`Phase\s+\d`), and pipe-table structures are NOT phase-token re-derivations
+ * and are not flagged.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+// The canonical phase-number token as it appears in SOURCE TEXT:
+//   \d+[A-Z]?(?:\.\d+)*   in a regex literal   -> one backslash before d/.
+//   \\d+[A-Z]?(?:\\.\\d+)* in a template string -> two backslashes
+// Also tolerate the [A-Za-z] letter-class and the [.-] (dot-or-dash) separator
+// near-variants that a few enumeration call sites use.
+const TOKEN_DRIFT_RE = /\\{1,2}d\+\[A-Z(?:a-z)?\]\??\(\?:(?:\\{1,2}\.|\[\.-\])\\{1,2}d\+\)\*/;
+
+const OWNER_MARK = 'phase-id-owner:';
+const CANON_REF = 'PHASE_NUMBER_TOKEN_SOURCE';
+
+/**
+ * Pure: find every literal re-derivation of the canonical phase-number token in
+ * `text` that is NOT sanctioned. A site is sanctioned when its line — or the
+ * line directly above it — contains `// phase-id-owner:`, or when the line
+ * references `PHASE_NUMBER_TOKEN_SOURCE` (i.e. it is built from the canonical
+ * source, not a literal). Returns [{ line, found }].
+ */
+function findPhaseIdRegexDrift(text) {
+  const out = [];
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const m = TOKEN_DRIFT_RE.exec(line);
+    if (!m) continue;
+    if (line.includes(OWNER_MARK)) continue;
+    if (i > 0 && lines[i - 1].includes(OWNER_MARK)) continue;
+    if (line.includes(CANON_REF)) continue;
+    out.push({ line: i + 1, found: m[0] });
+  }
+  return out;
+}
+
+// Authored TypeScript source only (the generated bin/lib/*.cjs mirror it).
+const SCAN_DIRS = ['src'];
+const SCAN_EXT = new Set(['.cts', '.ts', '.mts']);
+// The canonical owner defines the grammar; it is exempt by construction.
+const EXEMPT = new Set([path.join('src', 'phase-id.cts')]);
+
+function walk(dir, acc) {
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return acc;
+  }
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name === '.git') continue;
+      walk(full, acc);
+    } else if (entry.isFile() && SCAN_EXT.has(path.extname(entry.name))) {
+      acc.push(full);
+    }
+  }
+  return acc;
+}
+
+/**
+ * Scan the authored source tree and return every unsanctioned phase-token
+ * re-derivation, each annotated with the repo-relative file path.
+ */
+function scanRepo(root) {
+  const violations = [];
+  for (const dir of SCAN_DIRS) {
+    for (const file of walk(path.join(root, dir), [])) {
+      const rel = path.relative(root, file);
+      if (EXEMPT.has(rel)) continue;
+      let text;
+      try {
+        text = fs.readFileSync(file, 'utf8');
+      } catch {
+        continue;
+      }
+      for (const d of findPhaseIdRegexDrift(text)) {
+        violations.push({ file: rel, ...d });
+      }
+    }
+  }
+  return violations;
+}
+
+function main() {
+  const root = path.join(__dirname, '..');
+  const violations = scanRepo(root);
+  if (violations.length === 0) {
+    process.stdout.write('ok phase-id-drift: no unsanctioned phase-token re-derivations outside phase-id.cts\n');
+    return;
+  }
+  process.stderr.write('phase-id-drift: literal re-derivation(s) of the canonical phase-number token found.\n');
+  process.stderr.write('Build the regex from phase-id.cjs `PHASE_NUMBER_TOKEN_SOURCE` (or phaseMarkdownRegexSource for a\n');
+  process.stderr.write('known number), or sanction the site with a `// phase-id-owner: <reason>` comment:\n');
+  for (const d of violations) {
+    process.stderr.write(`  ${d.file}:${d.line}  ${d.found}\n`);
+  }
+  process.exitCode = 1;
+}
+
+if (require.main === module) main();
+
+module.exports = { findPhaseIdRegexDrift, scanRepo, TOKEN_DRIFT_RE };