test(#3090): stop exempting violations under categories that do not fit

An allow-test-rule annotation citing a category that does not apply is worse
than no annotation, because it reads as reviewed. Eight were confirmed by
reading the assertions each one covered, and auditing the rest found five more
plus one refutation — a converter test whose wording described the wrong
mechanism while the covered assertion genuinely was deployed-text.

The instructive one used the CANONICAL string for the same mistake: STATE.md
command output labelled as a deployed artifact. A canonical string is not
evidence the category fits, which is why normalising strings alone would have
laundered the problem rather than fixed it. Every mapping the audit had inferred
rather than code-verified was spot-checked before rewriting, and the ones that
turned out not to fit were re-annotated rather than relabelled.

Fourteen STATE.md assertions had a typed extractor available all along and now
use it; their annotations came out because nothing needs exempting. Eight
assertions genuinely need a production change first — CLI stdout and stderr with
no structured mode — and are tagged pending-migration-to-typed-ir citing #3090,
which is what that category is for. It had zero real uses before this, while one
file carried a real citation to migration issue #2974 under a non-canonical tag.

Six annotations covered assertions that do no text matching at all. An exemption
for a violation that does not exist is noise that makes the real ones harder to
audit; those are removed.

atomic-write-coverage gains the annotation it always warranted — its own
docstring describes a structural-regression-guard while the file carried none.

Fifty-nine non-canonical strings across roughly thirty files are normalised, and
the allow-test-rule allowlist is regenerated to match. 472 annotations became
463: every one now uses a canonical category, and the two remaining
non-canonical strings are ESLint RuleTester fixtures, not annotations.

Refs #3057

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/runtime-converters.test.cjs

@@ -973,7 +973,11 @@ test('claude runtime does NOT rewrite the runtime default — stamping is non-cl
 // ---------------------------------------------------------------------------
 
 test('regression: every edited workflow gets codex-stamped (source↔engine parity, all surfaces) (#1515)', () => {
-  // allow-test-rule: emitted workflow runtime-resolution shell block is the runtime contract surface (#1515) — asserts on engine-transformed output of the real source
+  // allow-test-rule: pending-migration-to-typed-ir [#3090]
+  // `out` is _applyRuntimeRewrites's engine-transformed shell text, not shipped
+  // source — substring-matching it is the "Rendered file" row CONTRIBUTING
+  // requires a typed-IR builder for. No such IR exists yet for the shell
+  // rewrite output; production change out of scope here. Tracked under #3090.
   const WORKFLOWS = ['execute-phase.md', 'autonomous.md', 'manager.md', 'diagnose-issues.md', 'quick.md'];
   const CLAUDE_RUNTIME = 'config-get runtime --default claude --raw 2>/dev/null || echo "claude"';
   const CODEX_RUNTIME = 'config-get runtime --default codex --raw 2>/dev/null || echo "codex"';
@@ -1065,7 +1069,11 @@ const FALSE_WT_LINE = 'config-get workflow.use_worktrees --default false --raw 2
 // ---------------------------------------------------------------------------
 
 test('parity: every non-Claude runtime stamps its own runtime default and use_worktrees=false on all workflows (#1521)', () => {
-  // allow-test-rule: emitted workflow runtime-resolution shell block is the runtime contract surface (#1521)
+  // allow-test-rule: pending-migration-to-typed-ir [#3090]
+  // `out` is _applyRuntimeRewrites's engine-transformed shell text, not shipped
+  // source — substring-matching it is the "Rendered file" row CONTRIBUTING
+  // requires a typed-IR builder for. No such IR exists yet for the shell
+  // rewrite output; production change out of scope here. Tracked under #3090.
   for (const rt of NON_CLAUDE) {
     for (const wf of WORKFLOWS) {
       const src = fs.readFileSync(
@@ -1181,7 +1189,10 @@ test('property: _stampNonClaudeRuntimeDefaults is idempotent (#1521)', () => {
 // ---------------------------------------------------------------------------
 
 test('execute-phase.md, quick.md, and diagnose-issues.md guards are generalized to != "claude" (not Codex-specific) (#1521)', () => {
-  // allow-test-rule: emitted workflow runtime-resolution shell block is the runtime contract surface (#1521)
+  // allow-test-rule: source-text-is-the-product (#1521)
+  // Reads the raw shipped workflow .md source directly (not engine-transformed
+  // output) and asserts on its literal guard-clause text — the deployed prose
+  // IS the runtime contract here.
   // #2584 Phase 3 (#2627): execute-phase.md graduated PAST the `!= "claude"`
   // guard — worktree isolation there is now keyed on the negotiated
   // `dispatch.isolation` capability, so no runtime name appears in its guard at
@@ -1226,7 +1237,9 @@ test('execute-phase.md, quick.md, and diagnose-issues.md guards are generalized
 // ---------------------------------------------------------------------------
 
 test('manager.md and autonomous.md gate run_in_background on FLATTEN=false, not a runtime name (#1521, graduated by #1708)', () => {
-  // allow-test-rule: orchestration dispatch gating in manager/autonomous .md is the runtime contract surface (#1521/#1708)
+  // allow-test-rule: source-text-is-the-product (#1521/#1708)
+  // Reads the raw shipped manager.md/autonomous.md workflow prose directly —
+  // the deployed orchestration dispatch gating text IS the runtime contract.
   const manager = fs.readFileSync(
     path.join(__dirname, '..', 'gsd-core', 'workflows', 'manager.md'),
     'utf8',
@@ -1263,7 +1276,9 @@ test('manager.md and autonomous.md gate run_in_background on FLATTEN=false, not
 });
 
 test('manager.md and autonomous.md no longer contain old "not claude" background-dispatch gating (#1521)', () => {
-  // allow-test-rule: orchestration dispatch gating in manager/autonomous .md is the runtime contract surface (#1521)
+  // allow-test-rule: source-text-is-the-product (#1521)
+  // Reads the raw shipped manager.md/autonomous.md workflow prose directly —
+  // the deployed orchestration dispatch gating text IS the runtime contract.
   const manager = fs.readFileSync(
     path.join(__dirname, '..', 'gsd-core', 'workflows', 'manager.md'),
     'utf8',