test(#1973): consolidate 48 workflow regression tests into workflow-aspect suites

Fold 48 issue-named workflow-markdown regression files into the canonical test
that owns each workflow aspect (execute-phase-*, plan-phase-*, quick-*, discuss-*,
worktree-cleanup, secure-phase, verify, update, settings, etc.), across 32 existing
suites. Verbatim block-scoped describe wrappers; 281 subtests conserved 1:1. No new
test files. Host-env pre-check: only gsd-settings-advanced spawns CLI and it sets no
GSD_WORKSTREAM/GSD_PROJECT value — no leak risk.

Regenerates regression-name allowlist (222->181), ratchets file-count allowlist
(verify 11->10), makes 30 relocated allow-test-rule exemptions issue-ref-compliant
(ADR-456; prunes 30 stale ids). lint:ci green.

Part of epic #1969. Closes #1973.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/secure-phase.test.cjs

@@ -706,3 +706,71 @@ describe('SECURE: security config variables resolved before use (#1625)', () =>
     );
   });
 });
+
+
+// ────────────────────────────────────────────────────────────────────────
+// Folded from tests/bug-3120-secure-phase-empty-register.test.cjs — consolidation epic #1969 (B4 #1973)
+// ────────────────────────────────────────────────────────────────────────
+{
+  const { describe: __foldDescribe } = require('node:test');
+  __foldDescribe("folded:bug-3120-secure-phase-empty-register (consolidation epic #1969 B4 #1973)", () => {
+'use strict';
+// allow-test-rule: reads product workflow markdown (secure-phase.md) to verify structural guard contract — not a source-grep test (see #3120)
+
+// Regression guard for bug #3120.
+//
+// secure-phase.md Step 3 short-circuited to Step 6 (write SECURITY.md)
+// whenever threats_open: 0, without distinguishing between:
+//   Case A: All plan-time threat_model threats are CLOSED (legitimate skip)
+//   Case B: No threat_model blocks were written at plan time (legacy phases)
+//          → rubber-stamps a clean SECURITY.md with zero audit performed
+//
+// Fix: Step 2c tracks `register_authored_at_plan_time` (true iff ≥1 PLAN
+// file contained a parseable <threat_model> block). Step 3 now requires BOTH
+// threats_open: 0 AND register_authored_at_plan_time to skip. If only
+// threats_open: 0 and NOT register_authored_at_plan_time, Step 5 runs in
+// retroactive-STRIDE mode.
+
+const { test, describe } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const ROOT = path.join(__dirname, '..');
+const src = fs.readFileSync(
+  path.join(ROOT, 'gsd-core', 'workflows', 'secure-phase.md'),
+  'utf8',
+);
+
+describe('bug #3120: secure-phase short-circuit guards', () => {
+  test('Step 2c tracks register_authored_at_plan_time', () => {
+    assert.ok(
+      src.includes('register_authored_at_plan_time'),
+      'secure-phase.md does not track register_authored_at_plan_time in Step 2c',
+    );
+  });
+
+  test('Step 3 short-circuit requires both conditions', () => {
+    assert.ok(
+      src.includes('threats_open: 0 AND register_authored_at_plan_time'),
+      'Step 3 short-circuit does not gate on both threats_open:0 AND register_authored_at_plan_time',
+    );
+  });
+
+  test('retroactive-STRIDE mode is documented for legacy phases', () => {
+    assert.ok(
+      src.includes('retroactive') || src.includes('Retroactive'),
+      'secure-phase.md does not document retroactive-STRIDE mode for legacy phases (no <threat_model> blocks)',
+    );
+  });
+
+  test('Step 5 auditor constraint varies by mode', () => {
+    assert.ok(
+      (src.includes('Verify mitigations') || src.includes('verify mitigations')) &&
+      (src.includes('Retroactive') || src.includes('retroactive')),
+      'Step 5 does not distinguish planned vs retroactive-STRIDE auditor constraint',
+    );
+  });
+});
+  });
+}