fix(#1749): close epic #1702 audit gaps — drift-guard bin/install.js, ci-test-scope wiring, ADR divergence (#1751)

Post-merge coverage-audit follow-ups to epic #1702 (found by an independent
gpt-5.5/high audit + adr-phase-coverage cross-reference). None are CRITICAL —
the 9-rule enforcement shipped and works; these close completeness/integrity
gaps between ADR-1703's promises and the as-built reality.

1. drift-guard bin/install.js scope (ADR-1703 L114-119): the drift guard
   covered src/runtime-homes.cts only; the ADR named bin/install.js too. Phase
   6's glob expansion made bin/install.js a covered surface. Extended
   tests/portability-vocab-drift.test.cjs with TWO sound checks: (a) any
   bin/install.js top-level function that directly returns path.*() must be in
   PATH_RETURNING_FNS (tight, 0 FP — the body-contains heuristic is unsound
   here, ~33 FPs); (b) a curated two-way existence lock on the installer path
   helpers (catches a rename making a vocab entry stale; keeps the curation in
   sync with PATH_RETURNING_FNS). The residual new-resolver boundary (temp-var
   shape) is documented.

2. ci-test-scope wiring (the Phase 6 portability selection rule was
   ineffective): eslint-rules/ was not in the product-code prefix list, so an
   eslint-rules-only change set code_changed=false and CLEARED the matched
   tests (reproduced: targeted_tests=[]). Added eslint-rules/ to the prefix
   list and the P1-P4 RuleTester suites to the selection rule (it previously
   listed only P5/P6). Verified: code_changed=true, 11 tests selected.

3. ADR-1703 acceptance note amended to record the two further as-built
   divergences: the disable-ban shipped as an out-of-band test (not the
   specified local/no-portability-disable meta-rule — the test runs outside
   ESLint so it cannot be self-disabled, at least as strong); and the
   drift-guard bin/install.js scope resolution above.

Epic #1702 all eight phase boxes now checked. No runtime change; no-changelog
(contributor tooling + docs).

Closes #1749

Co-authored-by: review-bot <review-bot@gsd>

docs/adr/1703-portability-enforcement-architecture.md

@@ -212,6 +212,28 @@ as-built deviations from the Phase 0 catalog, both within this ADR's precision d
 The forward "how to add a portability rule" recipe delivered by this phase lives at
 [`docs/contributing/adding-a-portability-rule.md`](../contributing/adding-a-portability-rule.md).
 
+Two further as-built deviations from the Phase 0 text, reconciled in the post-merge
+coverage audit (#1749):
+
+- **Disable-ban mechanism — meta-rule → out-of-band test.** §"Strictness" specified a
+  `local/no-portability-disable` ESLint meta-rule to ban inline disables of portability
+  rules. What shipped is [`tests/portability-rule-disable-ban.test.cjs`](../../tests/portability-rule-disable-ban.test.cjs)
+  — a `node:test` that scans files for disable directives **outside ESLint**, so it cannot
+  itself be eslint-disabled (an advantage over an in-process meta-rule, which the ADR noted
+  as the motivating risk). The substitution is at least as strong; recorded here so the
+  ADR's written mechanism matches the as-built one.
+
+- **Drift-guard `bin/install.js` scope.** §"Architecture" said the drift guard parses
+  `src/runtime-homes.cts` *and the relevant `bin/install.js` exports*. The shipped
+  [`tests/portability-vocab-drift.test.cjs`](../../tests/portability-vocab-drift.test.cjs)
+  originally covered only `runtime-homes.cts`; the audit extended it to `bin/install.js`
+  with a SOUND shape only (a top-level function that directly `return path.*(...)` must be
+  registered; plus a curated two-way existence lock on the installer path helpers). The
+  looser body-contains heuristic used for `runtime-homes.cts` is unsound for the generated
+  12k-line installer (~33 false positives), so a new installer resolver that builds a path
+  via a temp variable relies on review — documented as a boundary in the test. The active
+  resolver module (`runtime-homes.cts`) remains fully drift-guarded by the looser heuristic.
+
 ## Alternatives considered
 
 1. **Keep extending the regex lint.** Rejected — the adversarial review proved it is