test(#1074): add additive per-file workflow size baseline guard (PR 1/3) (#1089)

* test(#1074): add additive per-file workflow size baseline guard (PR 1/3)

Introduces a committed per-file size baseline scheme alongside (not replacing)
the existing tier anti-creep tests. Green by construction — the baseline
records current sizes, so both schemes pass side by side during migration.

- scripts/lib/allowlist-ratchet.cjs: add assertFileBaseline (third pure helper,
  same injected-fail style) — per-file growth/shrink/add/remove diff vs baseline.
- scripts/workflow-size.cjs: single source of truth for LF-normalized byte
  counting (#683) + workflow enumeration, shared by the guard and the generator
  so they can never measure differently. Lives in scripts/ root (NOT scripts/lib/)
  because it is dev/CI-only tooling — scripts/lib/ is bundled into the installed
  runtime, scripts/ root is not, so this keeps it out of the shipped payload.
- scripts/update-size-baseline.cjs + npm run size:baseline: regenerate the
  snapshot (sorted keys, trailing newline, idempotent).
- tests/workflow-size-baseline.json: generated snapshot (88 workflows).
- tests/workflow-size-budget.test.cjs: import the shared counter (drops the
  duplicated local byteCount) and add the per-file baseline describe block.
- Tests for the helper, the shared module, and the generator (incl. round-trip
  and fault-injection cases).

Refs #1074. Part 1 of 3; PR 2 swaps enforcement, PR 3 covers the agent test.

* test(#1074): regenerate workflow baseline after Update-branch merge with next

The 'Update branch' merge (652a916b) pulled in next's update.md change (#1090)
without regenerating the snapshot, leaving the per-file baseline stale by one
file. Re-ran `npm run size:baseline` so the committed baseline matches the
merged workflow files.

Refs #1074.

---------

Co-authored-by: Tom Boucher <trekkie@nomorestars.com>

tests/workflow-size-budget.test.cjs

@@ -66,10 +66,12 @@ const assert = require('node:assert/strict');
 const fs = require('fs');
 const os = require('node:os');
 const path = require('path');
-const { assertTightCeiling } = require('../scripts/lib/allowlist-ratchet.cjs');
+const { assertTightCeiling, assertFileBaseline } = require('../scripts/lib/allowlist-ratchet.cjs');
+const { lfByteCount: byteCount, measureWorkflows } = require('../scripts/workflow-size.cjs');
 const { cleanup } = require('./helpers.cjs');
 
 const WORKFLOWS_DIR = path.join(__dirname, '..', 'gsd-core', 'workflows');
+const BASELINE_PATH = path.join(__dirname, 'workflow-size-baseline.json');
 
 // Grace band: maximum allowed slack (ceiling − actualMax) in BYTES before a
 // ceiling is considered too loose. 3000 bytes ≈ the prior 60-line grace
@@ -127,18 +129,10 @@ function budgetFor(workflow) {
   return { tier: 'DEFAULT', limit: DEFAULT_BUDGET };
 }
 
-function byteCount(filePath) {
-  // Count bytes as on an LF checkout, so the budget is platform-independent.
-  // The tier ceilings are calibrated against `wc -c` on a Unix (LF) checkout,
-  // but these .md files have no `eol=lf` in .gitattributes, so Windows checks
-  // them out as CRLF. Counting raw on-disk bytes there adds one byte per line,
-  // which fails CI on the high-water-mark file (execute-phase.md) on Windows
-  // ONLY — a false positive that diverges from the LF calibration basis (#683).
-  // Stripping CR yields the same LF byte count on every platform. Still a raw
-  // byte count (not the old trailing-newline-stripping lineCount()).
-  const content = fs.readFileSync(filePath, 'utf-8');
-  return Buffer.byteLength(content.replace(/\r\n/g, '\n'), 'utf-8');
-}
+// byteCount (LF-normalized, #683) is imported as `lfByteCount` from
+// scripts/workflow-size.cjs — the single source of truth shared with the
+// baseline generator so the guard and the snapshot can never measure
+// differently. See the #683 regression test at the bottom of this file.
 
 describe('SIZE: workflow byte-size budget', () => {
   for (const workflow of ALL_WORKFLOWS) {
@@ -159,6 +153,31 @@ describe('SIZE: workflow byte-size budget', () => {
   }
 });
 
+describe('SIZE: per-file workflow baseline (issue #1074)', () => {
+  // Per-file exact-size ratchet. Unlike the tier anti-creep block below — which
+  // only binds the single largest file in each tier — this guards EVERY
+  // workflow file by name against a committed snapshot
+  // (tests/workflow-size-baseline.json). Growth fails with the file and delta;
+  // shrinkage fails as a stale snapshot (regenerate to ratchet down). The fix
+  // for any failure is `npm run size:baseline` plus a PR justification for
+  // genuine growth (or lazy extraction). Runs side-by-side with the tier tests
+  // during the #1074 migration; the tier anti-creep block is removed in a
+  // follow-up once this is established.
+  test('every workflow file matches its committed baseline', () => {
+    const baseline = JSON.parse(fs.readFileSync(BASELINE_PATH, 'utf-8'));
+    const current = measureWorkflows();
+    assertFileBaseline({
+      label: 'workflow-size',
+      current,
+      baseline,
+      fail: assert.fail,
+      updateHint:
+        'Run `npm run size:baseline` to update tests/workflow-size-baseline.json, ' +
+        'then justify any growth in your PR (or extract content lazily — see workflows/discuss-phase/).',
+    });
+  });
+});
+
 describe('SIZE: tier anti-creep (tighten-only ceilings, issue #597)', () => {
   // For each tier, compute the high-water mark (in bytes) across all files in
   // that tier and assert the ceiling stays tight. Prevents budgets from