fix(#2665): exclude the test-instrumentation chain from the npm tarball

Review round 4, Major 1: scripts/live-config-guard.cjs is pure test
instrumentation and was shipping to every npm install. The repo already
carries the exclusion convention (gen-emitted-baseline, qa-smell-ratchet)
in the same files[] array.

Excluding the guard alone would trip the #2858 shipped-requires-only-shipped
gate: run-tests.cjs (shipped) requires it at load time, and
affected-tests-lib.cjs / run-affected-tests.cjs sit on the same chain. The
four files are one closed require chain of test instrumentation, so the
exclusion covers the chain, not one link. The guard's LOCATION header cited
affected-tests-lib.cjs as "the precedent for a non-shipped helper", which
npm pack disproves — rewritten to the tarball-exclusion fact.

scripts/live-config-guard.cjs

@@ -22,8 +22,11 @@
  * LOCATION — `scripts/`, deliberately NOT `scripts/lib/`. The installer copies
  * `scripts/lib/` into every user's config dir wholesale (readdirSync), while
  * uninstall removes only an explicit allowlist, so a test-only module placed
- * there would ship to users AND survive uninstall. `scripts/affected-tests-lib.cjs`
- * is the precedent for a non-shipped helper at this level.
+ * there would ship to users AND survive uninstall. This file is also excluded
+ * from the npm tarball (`package.json` `files[]` `!scripts/live-config-guard.cjs`,
+ * alongside its whole require chain: run-tests.cjs, affected-tests-lib.cjs,
+ * run-affected-tests.cjs — excluding one link alone would trip the #2858
+ * shipped-requires-only-shipped gate on the links that still shipped).
  *
  * SCOPE — ownership-based, not whole-root. It watches entries GSD unambiguously
  * owns: the top-level install footprint (`GSD_OWNED_ENTRIES`) plus `gsd-`-prefixed