chore: move committed-generated-artifact freshness checks to lint:ci (#2000)

gsd-test's build leg runs the full 'npm run build' (which regenerates
capability-registry.cjs, loop-host-contract.cjs, package-identity.cjs, etc.),
so committed-freshness guards that lived in the unit suite were masked there:
gsd-test passed a stale-commit that CI's shard-1/3 test then red-flagged
(caught live on PR #1998). The mandated pre-push gate was green on a commit
CI correctly flagged.

Move the committed-state --check guards into a new 'lint:generated-sync'
script wired into lint:ci (the single orchestrated entry point the lint-tests
CI job already runs on a build:lib-only tree, so the committed artifacts are
checked without regeneration). gsd-test no longer contains these guards, so
it can no longer mask them.

- package.json: add lint:generated-sync (7 generators --check); wire into lint:ci.
- generate-package-identity.cjs: add --check mode (was the only generator
  without it); no-arg behaviour unchanged (still writes, as build expects).
- Remove the committed-freshness guards from the unit suite, keeping all
  behavioral/structural tests:
    - capability-registry.test.cjs: drop the --check describe.
    - loop-host-contract.test.cjs: drop the committed-file staleness test
      (keep the normalizeLineEndings unit test).
    - capability-matrix-sync.test.cjs: drop --check + byte-for-byte (keep the
      architectural content invariants: every cap appears, security ship:pre).
    - issue-844-manifest-version-sync.test.cjs: drop describe D (--check).
    - issue-498-package-identity.test.cjs: drop the drift-check test (keep
      behavioral module-export tests); drop the now-unused render import and
      its allow-test-rule exemption (allowlist ratcheted 175 -> 174).

tests/loop-host-contract.test.cjs

@@ -388,30 +388,17 @@ describe('buildContract cross-check drift guard', () => {
 
 // ─── 6. --check: CRLF-agnostic + committed-file staleness guard ──────────────
 
-describe('normalizeLineEndings and committed-file staleness', () => {
+describe('normalizeLineEndings', () => {
   test('normalizeLineEndings strips CR characters', () => {
     const crlf = 'line1\r\nline2\r\nline3';
     const lf = 'line1\nline2\nline3';
     assert.strictEqual(normalizeLineEndings(crlf), lf);
     assert.strictEqual(normalizeLineEndings(lf), lf);
   });
-
-  test('committed loop-host-contract.cjs is up to date (--check passes)', () => {
-    // Build the live contract from the real workflows
-    const contract = buildContract();
-    const live = serializeContract(contract);
-
-    // Read the committed file
-    const committed = fs.readFileSync(CONTRACT_PATH, 'utf8');
-
-    // FIX 4: Full-content comparison — no generated-by-line stripping needed
-    // because the serializer has no nondeterministic content (no timestamp).
-    assert.strictEqual(
-      normalizeLineEndings(committed),
-      normalizeLineEndings(live),
-      'committed loop-host-contract.cjs is stale — run: node scripts/gen-loop-host-contract.cjs --write',
-    );
-  });
+  // The committed-loop-host-contract.cjs freshness guard moved to
+  // `npm run lint:generated-sync` (gen-loop-host-contract.cjs --check), where it
+  // runs against the committed file in both local and CI lint lanes — instead of
+  // being masked by gsd-test's `npm run build` leg regenerating the artifact.
 });
 
 // ─── 7. STEP_WORKFLOWS and CANONICAL_POINTS exported constants ────────────────