chore: move committed-generated-artifact freshness checks to lint:ci (#2000)

gsd-test's build leg runs the full 'npm run build' (which regenerates
capability-registry.cjs, loop-host-contract.cjs, package-identity.cjs, etc.),
so committed-freshness guards that lived in the unit suite were masked there:
gsd-test passed a stale-commit that CI's shard-1/3 test then red-flagged
(caught live on PR #1998). The mandated pre-push gate was green on a commit
CI correctly flagged.

Move the committed-state --check guards into a new 'lint:generated-sync'
script wired into lint:ci (the single orchestrated entry point the lint-tests
CI job already runs on a build:lib-only tree, so the committed artifacts are
checked without regeneration). gsd-test no longer contains these guards, so
it can no longer mask them.

- package.json: add lint:generated-sync (7 generators --check); wire into lint:ci.
- generate-package-identity.cjs: add --check mode (was the only generator
  without it); no-arg behaviour unchanged (still writes, as build expects).
- Remove the committed-freshness guards from the unit suite, keeping all
  behavioral/structural tests:
    - capability-registry.test.cjs: drop the --check describe.
    - loop-host-contract.test.cjs: drop the committed-file staleness test
      (keep the normalizeLineEndings unit test).
    - capability-matrix-sync.test.cjs: drop --check + byte-for-byte (keep the
      architectural content invariants: every cap appears, security ship:pre).
    - issue-844-manifest-version-sync.test.cjs: drop describe D (--check).
    - issue-498-package-identity.test.cjs: drop the drift-check test (keep
      behavioral module-export tests); drop the now-unused render import and
      its allow-test-rule exemption (allowlist ratcheted 175 -> 174).

tests/issue-844-manifest-version-sync.test.cjs

@@ -338,17 +338,9 @@ describe('E: stageManifests — non-git dir is a no-op, not a throw', () => {
 });
 
 // ─── D: CLI --check exits 0 when in sync ─────────────────────────────────────
-describe('D: CLI --check exits 0 when manifests are in sync', () => {
-
-  test('node scripts/sync-manifest-versions.cjs --check exits 0', () => {
-    // Will throw if exit code != 0
-    execFileSync(
-      process.execPath,
-      [path.join(ROOT, 'scripts', 'sync-manifest-versions.cjs'), '--check'],
-      { cwd: ROOT }
-    );
-  });
-});
+// Moved to `npm run lint:generated-sync` (sync-manifest-versions.cjs --check),
+// which runs against the committed manifests in both local and CI lint lanes
+// instead of being masked by gsd-test's `npm run build` leg.
 
 // ─── F: version script includes capability-registry regen (#1498) ─────────────
 //