feat(#1726): G1-G6 portability AST rules; fix all offenders; delete the ratchet (Phase 4) (#1731)

Phase 4 of epic #1702. Closes #1726.

scripts/lint-allow-test-rule-refs.allowlist.json

@@ -313,7 +313,6 @@
   "tests/verify-test-quality.test.cjs :: source-text-is-the-product",
   "tests/verify-work-auto-transition.test.cjs :: source-text-is-the-product",
   "tests/windows-robustness.test.cjs :: source-text-is-the-product",
-  "tests/windows-test-parity-guard.test.cjs :: structural-regression-guard",
   "tests/workflow-compat.test.cjs :: source-text-is-the-product",
   "tests/workflow-guard-registration.test.cjs :: structural-regression-guard",
   "tests/workflow-maintainer-skip.test.cjs :: source-text-is-the-product",

scripts/prompt-injection-scan.sh

@@ -98,6 +98,10 @@ ALLOWLIST=(
   # contain shell-exec command strings (exec("sh -c …"), execFileSync('bash',['-c',…]))
   # as test DATA the rule must lint — not attack vectors. ADR-1703 Phase 3 (#1720).
   'tests/no-unguarded-nonportable-exec.rule.test.cjs'
+  # RuleTester fixtures for the local/no-bare-npm-exec ESLint rule contain npm
+  # exec command strings (execFileSync('npm', ['install'])) as test DATA the rule
+  # must lint — not attack vectors. ADR-1703 Phase 4 (#1726).
+  'tests/no-bare-npm-exec.rule.test.cjs'
 )
 
 is_allowlisted() {