chore: move committed-generated-artifact freshness checks to lint:ci (#2000)

gsd-test's build leg runs the full 'npm run build' (which regenerates
capability-registry.cjs, loop-host-contract.cjs, package-identity.cjs, etc.),
so committed-freshness guards that lived in the unit suite were masked there:
gsd-test passed a stale-commit that CI's shard-1/3 test then red-flagged
(caught live on PR #1998). The mandated pre-push gate was green on a commit
CI correctly flagged.

Move the committed-state --check guards into a new 'lint:generated-sync'
script wired into lint:ci (the single orchestrated entry point the lint-tests
CI job already runs on a build:lib-only tree, so the committed artifacts are
checked without regeneration). gsd-test no longer contains these guards, so
it can no longer mask them.

- package.json: add lint:generated-sync (7 generators --check); wire into lint:ci.
- generate-package-identity.cjs: add --check mode (was the only generator
  without it); no-arg behaviour unchanged (still writes, as build expects).
- Remove the committed-freshness guards from the unit suite, keeping all
  behavioral/structural tests:
    - capability-registry.test.cjs: drop the --check describe.
    - loop-host-contract.test.cjs: drop the committed-file staleness test
      (keep the normalizeLineEndings unit test).
    - capability-matrix-sync.test.cjs: drop --check + byte-for-byte (keep the
      architectural content invariants: every cap appears, security ship:pre).
    - issue-844-manifest-version-sync.test.cjs: drop describe D (--check).
    - issue-498-package-identity.test.cjs: drop the drift-check test (keep
      behavioral module-export tests); drop the now-unused render import and
      its allow-test-rule exemption (allowlist ratcheted 175 -> 174).

tests/capability-matrix-sync.test.cjs

@@ -1,41 +1,28 @@
 'use strict';
 
 /**
- * capability-matrix-sync.test.cjs — ADR-1244 Phase 6 (D9) drift guard.
+ * capability-matrix-sync.test.cjs — ADR-1244 Phase 6 (D9) content invariants.
  *
- * Asserts the committed docs/reference/capability-matrix.md is exactly what
- * scripts/gen-capability-matrix.cjs would generate from the current registry.
- * If a capability is added/removed or its tier/role/engines/extension-points/
- * hook-kinds change without regenerating the matrix, this fails — the same
- * pattern that keeps docs/INVENTORY-MANIFEST.json and capability-registry.cjs honest.
+ * The committed docs/reference/capability-matrix.md FRESHNESS guard
+ * (`gen-capability-matrix.cjs --check` + byte-for-byte) moved to
+ * `npm run lint:generated-sync`, where it runs against the committed file in
+ * both local and CI lint lanes — instead of being masked by gsd-test's
+ * `npm run build` leg regenerating artifacts. What remains here are the
+ * architectural CONTENT invariants the matrix must satisfy regardless of how
+ * freshness is enforced: every first-party capability appears as a row, and
+ * the rendered extension points reflect the registry (not placeholders).
  */
 
 const { describe, test } = require('node:test');
 const assert = require('node:assert/strict');
 const fs = require('node:fs');
 const path = require('node:path');
-const { execFileSync } = require('node:child_process');
 
 const ROOT = path.resolve(__dirname, '..');
-const GENERATOR = path.join(ROOT, 'scripts', 'gen-capability-matrix.cjs');
 const MATRIX = path.join(ROOT, 'docs', 'reference', 'capability-matrix.md');
-const { buildMatrix } = require('../scripts/gen-capability-matrix.cjs');
 const registry = require('../gsd-core/bin/lib/capability-registry.cjs');
 
-describe('capability-matrix drift guard (ADR-1244 Phase 6)', () => {
-  test('the committed matrix is in sync with the registry (`gen-capability-matrix.cjs --check` exits 0)', () => {
-    // execFileSync throws if the generator exits non-zero (i.e. the committed file is stale).
-    assert.doesNotThrow(() => {
-      execFileSync(process.execPath, [GENERATOR, '--check'], { cwd: ROOT, stdio: 'pipe' });
-    }, 'committed capability-matrix.md is stale — run: node scripts/gen-capability-matrix.cjs --write');
-  });
-
-  test('buildMatrix(registry) equals the committed file byte-for-byte (modulo line endings)', () => {
-    const generated = buildMatrix(registry).replace(/\r\r?\n/g, '\n').replace(/\r?\n+$/, '\n');
-    const committed = fs.readFileSync(MATRIX, 'utf8').replace(/\r\r?\n/g, '\n').replace(/\r?\n+$/, '\n');
-    assert.equal(committed, generated);
-  });
-
+describe('capability-matrix content invariants (ADR-1244 Phase 6)', () => {
   test('every first-party capability in the registry appears as a matrix row', () => {
     const md = fs.readFileSync(MATRIX, 'utf8');
     for (const cap of Object.values(registry.capabilities)) {