fix(#2694): normalize CRLF before frontmatter-boundary match in code-review workflows (#2839)

* test(#2694): CRLF frontmatter boundary regression for code-review workflows

The code-review / code-review-fix workflows embed inline node -e one-liners
whose frontmatter boundary regex used a literal \n, silently returning null
on CRLF-saved SUMMARY.md / REVIEW.md / REVIEW-FIX.md artifacts and dropping
every file in that summary (acceptance: per-artifact, no warning when the
phase aggregate stays non-zero).

Adds:
- behavioral CRLF==LF boundary extraction tests (replica of the shipped
  one-liner's boundary step), proving the buggy literal-\n returns null on
  CRLF while the fixed normalize-then-match yields a byte-identical body;
- a structural-regression-guard (allow-test-rule: structural-regression-guard)
  that reads the two shipped workflow files and asserts every boundary site
  normalizes \r\n -> \n before matching, so a revert of the fix is caught.

* fix(#2694): normalize CRLF before frontmatter-boundary match in code-review workflows

The code-review and code-review-fix workflows embed nine inline node -e
one-liners that extract YAML frontmatter via a boundary regex
  content.match(/^---\n([\s\S]*?)\n---/)
The literal \n defeated any CRLF-saved artifact (\r between --- and the line
terminator), so SUMMARY.md / REVIEW.md / REVIEW-FIX.md saved with CRLF
endings silently contributed zero files (or 'unknown' status / 'invalid')
with no per-artifact warning. The Tier-3 git-diff fallback only fires when
the aggregate across all summaries is zero, so a single CRLF summary among
LF summaries produced no signal at all.

Normalize \r\n -> \n once before the existing boundary match at all nine
sites (code-review.md x3, code-review-fix.md x6). Byte-identical to the LF
path; mirrors the canonical src/frontmatter.cts extractFrontmatter intent
(CRLF == LF at the boundary); zero risk of \r leaking into field values
consumed by the inner JS or the shell grep/cut pipeline.

RED @ 94d0213 (3 failures, structural guard caught the shipped-text bug,
both linux-node22+24 lanes).GREEN pending.

* chore(#2694): acknowledge code-review workflow growth + changeset fragment

emitted-attribution (ADR-2719) reports the byte growth from the CRLF-normalize
insertion in code-review.md (+69) and code-review-fix.md (+138); both are the
intended #2694 fix. Adds the .changeset Fixed fragment (pr:0, backfilled post-PR).

* test(#2694): mixed CRLF/LF phase yields the union of both artifacts (criterion 2)

The spec-axis review flagged that acceptance criterion 2 (a phase with a mix
of CRLF-affected and unaffected artifacts no longer silently drops the CRLF
artifact's contribution) was only transitively satisfied. Adds an explicit
mixed-phase test replicating the full shipped Tier-2 extractor (boundary +
inner key_files parse) across one LF and one CRLF SUMMARY.md, asserting the
union of both — plus a RED proof showing the buggy boundary drops the CRLF
artifact silently (aggregate non-zero, so the Tier-3 eq-zero fallback never
fired). Locks the silent-partial-masking behavior the triage named as the more
serious half of the defect.

* docs(changeset): backfill #2694 PR number to 2839

* fix(#2694): make the CRLF regression test itself CRLF-lint-clean

CI lint-tests caught that the new test tripped local/no-crlf-fragile-split:
- the frontmatter boundary regex replicas (fixed + buggy) were RegExpLiterals
  with a bare \n; the rule flags frontmatter-shape regexes unconditionally.
  Build them via new RegExp(...) (byte-identical .source to the shipped literal)
  so the faithful replica is not a lint violation — the buggy replica MUST keep
  the literal \n, that is the bug it demonstrates.
- the structural guard's src.split('\n') on the readFileSync'd workflow file
  was genuinely CRLF-fragile; use /\r?\n/ per the rule's canonical fix.
- the allow-test-rule annotation gains its (#2694) tracking ref per ADR-456.

lint:ci now exit 0 (incl. lint-allow-test-rule-refs, lint-emitted-drift-ack,
lint-fix-has-regression-test: PASS).

gsd-core/workflows/code-review.md

@@ -171,7 +171,7 @@ if [ -z "$FILES_OVERRIDE" ]; then
       EXTRACTED=$(node -e "
         const fs = require('fs');
         const content = fs.readFileSync('$summary', 'utf-8');
-        const match = content.match(/^---\n([\s\S]*?)\n---/);
+        const match = content.replace(/\r\n/g, '\n').match(/^---\n([\s\S]*?)\n---/);
         if (!match) { process.exit(0); }
         const yaml = match[1];
         const files = [];
@@ -549,7 +549,7 @@ if [ -f "${REVIEW_PATH}" ]; then
   HAS_STATUS=$(REVIEW_PATH="${REVIEW_PATH}" node -e "
     const fs = require('fs');
     const content = fs.readFileSync(process.env.REVIEW_PATH, 'utf-8');
-    const match = content.match(/^---\n([\s\S]*?)\n---/);
+    const match = content.replace(/\r\n/g, '\n').match(/^---\n([\s\S]*?)\n---/);
     if (match && /status:/.test(match[1])) { console.log('valid'); } else { console.log('invalid'); }
   " 2>/dev/null)
   
@@ -622,7 +622,7 @@ Extract frontmatter between `---` delimiters first to avoid matching values in t
 FRONTMATTER=$(REVIEW_PATH="${REVIEW_PATH}" node -e "
   const fs = require('fs');
   const content = fs.readFileSync(process.env.REVIEW_PATH, 'utf-8');
-  const match = content.match(/^---\n([\s\S]*?)\n---/);
+  const match = content.replace(/\r\n/g, '\n').match(/^---\n([\s\S]*?)\n---/);
   if (match) process.stdout.write(match[1]);
 " 2>/dev/null)