chore: move committed-generated-artifact freshness checks to lint:ci (#2000)

gsd-test's build leg runs the full 'npm run build' (which regenerates
capability-registry.cjs, loop-host-contract.cjs, package-identity.cjs, etc.),
so committed-freshness guards that lived in the unit suite were masked there:
gsd-test passed a stale-commit that CI's shard-1/3 test then red-flagged
(caught live on PR #1998). The mandated pre-push gate was green on a commit
CI correctly flagged.

Move the committed-state --check guards into a new 'lint:generated-sync'
script wired into lint:ci (the single orchestrated entry point the lint-tests
CI job already runs on a build:lib-only tree, so the committed artifacts are
checked without regeneration). gsd-test no longer contains these guards, so
it can no longer mask them.

- package.json: add lint:generated-sync (7 generators --check); wire into lint:ci.
- generate-package-identity.cjs: add --check mode (was the only generator
  without it); no-arg behaviour unchanged (still writes, as build expects).
- Remove the committed-freshness guards from the unit suite, keeping all
  behavioral/structural tests:
    - capability-registry.test.cjs: drop the --check describe.
    - loop-host-contract.test.cjs: drop the committed-file staleness test
      (keep the normalizeLineEndings unit test).
    - capability-matrix-sync.test.cjs: drop --check + byte-for-byte (keep the
      architectural content invariants: every cap appears, security ship:pre).
    - issue-844-manifest-version-sync.test.cjs: drop describe D (--check).
    - issue-498-package-identity.test.cjs: drop the drift-check test (keep
      behavioral module-export tests); drop the now-unused render import and
      its allow-test-rule exemption (allowlist ratcheted 175 -> 174).

tests/capability-registry.test.cjs

@@ -836,23 +836,6 @@ describe('normalizeLineEndings', () => {
   });
 });
 
-describe('committed gsd-core/bin/lib/capability-registry.cjs is not stale', () => {
-  test('gen-capability-registry.cjs --check exits 0 (committed registry is up to date)', () => {
-    const result = spawnSync(
-      process.execPath,
-      [require('node:path').join(ROOT, 'scripts', 'gen-capability-registry.cjs'), '--check'],
-      { cwd: ROOT, encoding: 'utf8' },
-    );
-    assert.strictEqual(
-      result.status,
-      0,
-      'gen-capability-registry.cjs --check failed — committed capability-registry.cjs is stale.\n' +
-      'Run: node scripts/gen-capability-registry.cjs --write\n' +
-      'stderr: ' + (result.stderr || ''),
-    );
-  });
-});
-
 // ─── 5. Registry shape from multiple capabilities ────────────────────────────
 
 describe('registry structure', () => {