fix(#4060): drive repo-baseline lint check in-process, not via a subprocess timeout race (#4065)

* test(#4060): failing-first regression for repo-baseline subtest timeout race

The "repo baseline passes" subtest in lint-allow-test-rule-refs.test.cjs
drives the script under test via a spawnSync subprocess with a fixed
30s timeout, which races the script's real wall-clock completion
against unbounded CI-load contention -- it has already died at this
race twice (#4060, and once before at a lower bound). Rewrites the
subtest to call the script's `main` directly, in-process, removing the
subprocess timeout race entirely. This commit only changes the test
(main is not yet exported), so it fails first with
`TypeError: scriptUnderTest.main is not a function`.

* fix(#4060): export lint-allow-test-rule-refs main() for in-process drive

The "repo baseline passes" subtest previously drove this script via a
spawnSync subprocess with a fixed 30s timeout, racing the script's
real completion time against unbounded CI-load contention -- it has
now died at that race twice (#4060, and once before at a lower
bound). A fixed timeout racing unbounded contention has no value that
is both tight and safe, so raising it again would not fix the
mechanism, only its odds.

Parameterizes main() to accept an explicit argv (defaulting to
process.argv.slice(2) only when omitted, so the CLI entrypoint is
unaffected) and exports it, so the test can call it directly,
in-process -- removing the subprocess and its spawnSync timeout kill
race entirely for this one row.

* fix(#4060): capture stderr too in the in-process repo-baseline subtest

Code-review finding: the in-process rewrite captured only console.log,
but main()'s real failure path throws a bare, messageless ExitError --
all diagnostic detail goes to process.stderr.write. The old
subprocess-based assertion embedded both stdout and stderr in its
failure message; this silently dropped that debuggability. Captures
process.stderr.write the same way (restored in finally) and surfaces
both streams in assertion failure messages and in a wrapped re-thrown
error on an unexpected throw from main().

---------

Co-authored-by: sim <sim@local>

scripts/lint-allow-test-rule-refs.cjs

@@ -721,8 +721,19 @@ function classifySites(files) {
   };
 }
 
-async function main() {
-  const args = process.argv.slice(2);
+/**
+ * @param {string[]} [argv] - CLI-style argv (excluding the node binary and
+ *   script path). Defaults to `process.argv.slice(2)` ONLY when omitted
+ *   (`undefined`) — the sole change from the prior hardcoded read, so the
+ *   CLI entrypoint below (`runMain(main)`, which calls `main()` with no
+ *   args) is unaffected. Passing an explicit array (including `[]`) lets a
+ *   caller — notably `tests/lint-allow-test-rule-refs.test.cjs`'s
+ *   "repo baseline passes" row, #4060 — drive this function directly,
+ *   in-process, with no subprocess and thus no `spawnSync` `timeout` to
+ *   race against CI-load contention.
+ */
+async function main(argv = process.argv.slice(2)) {
+  const args = argv;
   const unknown = args.filter((a) => a !== '--help');
   if (unknown.length > 0) {
     throw new ExitError(2, `lint-allow-test-rule-refs: unknown argument(s): ${unknown.join(', ')}`);
@@ -853,6 +864,7 @@ module.exports = {
   classifyFile,
   classifySites,
   classifyCode,
+  main,
 };
 
 if (require.main === module) {