test(#2974): migrate 8 test files to typed-IR assertions (#3016)

* test(#2974): migrate 8 test files to typed-IR assertions

Replaces raw stdout/stderr substring matching with structured-field
assertions per CONTRIBUTING.md "Prohibited: Raw Text Matching on Test
Outputs". Adds shared infrastructure for typed error emission so this
pattern is the easy path going forward.

Shared infrastructure:
- core.cjs: ERROR_REASON frozen enum + setJsonErrorMode/getJsonErrorMode
- gsd-tools.cjs: --json-errors CLI flag, parsed before subcommand dispatch
- config.cjs: typed reasons at all 7 error sites
- graphify.cjs: GRAPHIFY_REASON enum + reason/timeout_ms in execGraphify result
- bin/install.js: pure buildSdkFailFastReport() IR builder + renderer
- hooks/gsd-session-state.sh, gsd-phase-boundary.sh: emit Claude Code
  hookSpecificOutput JSON envelope with typed state_present/config_mode/
  planning_modified/file_path fields (no-op when hooks.community is off)

Test migrations (all pass, 171 tests across the 8 files):
- bug-2649-sdk-fail-fast: assert on ir.reason / ir.context / ir.fix_command
- bug-2687-config-read-warning-parity: assert.equal stderr === ''
- bug-2796-arg-parsing-regression: assert on result.json.updated/.phase
- bug-2838-summary-rescue: parse rescue footer, assert mtime invariant
- bug-2943-config-get-context-window: parse JSON, assert ERROR_REASON.CONFIG_KEY_NOT_FOUND
- graphify: assert reason === GRAPHIFY_REASON.ENOENT/TIMEOUT
- hooks-opt-in: parse hookSpecificOutput, assert typed fields
- security-scan: reclassified as source-text-is-the-product (scan label
  output and CI workflow YAML ARE the deployed contract)

Verification: lint-no-source-grep clean (0 violations), full suite
6741/6741 pass.

Closes #2974

* test(#2974): address CR feedback — typed code field, robust idempotency

Two CodeRabbit findings on #3016 addressed:

1. tests/hooks-opt-in.test.cjs:355 (Minor, inline) —
   parsed.reason.includes('Conventional Commits') was still substring
   matching after the typed-IR migration. Fixed at the source: the
   gsd-validate-commit hook now emits a typed `code` field
   ('CONVENTIONAL_COMMITS_VIOLATION', 'COMMIT_SUBJECT_TOO_LONG')
   alongside the human-readable `reason`. Test asserts strictEqual
   on the code; the prose copy is no longer part of the test contract.

2. tests/bug-2838-summary-rescue-gitignored-planning.test.cjs:224-250
   (Outside-diff) — mtimeMs alone can stay unchanged on coarse-grained
   filesystems (HFS+, FAT) when two rewrites land within the same
   timestamp tick, falsely passing the idempotency assertion.
   Replaced with a full snapshot (mtimeMs, ctimeMs, size, ino, sha256
   of contents) compared via assert.deepStrictEqual — the hash
   catches any rewrite the timestamp would miss.

Verification: 30/30 pass on the two affected files; lint-no-source-grep
clean (0 violations across 368 test files).

tests/graphify.test.cjs

@@ -1,8 +1,9 @@
 'use strict';
 
-// allow-test-rule: pending-migration-to-typed-ir [#2974]
-// Tracked in #2974 for migration to typed-IR assertions per CONTRIBUTING.md
-// "Prohibited: Raw Text Matching on Test Outputs". Do not copy this pattern.
+// Migrated to typed-IR (#2974): execGraphify now returns a typed
+// `reason` field (GRAPHIFY_REASON enum) alongside exitCode/stdout/stderr.
+// Tests assert on result.reason instead of grepping stderr for failure
+// phrases like 'not found' or 'timed out'.
 
 /**
  * Tests for get-shit-done/bin/lib/graphify.cjs
@@ -23,6 +24,7 @@ const {
   isGraphifyEnabled,
   disabledResponse,
   execGraphify,
+  GRAPHIFY_REASON,
   checkGraphifyInstalled,
   checkGraphifyVersion,
   // Phase 2
@@ -185,7 +187,9 @@ describe('execGraphify', () => {
 
     const result = execGraphify('/tmp', ['build']);
     assert.strictEqual(result.exitCode, 127);
-    assert.ok(result.stderr.includes('not found'));
+    // Migrated #2974: assert on the typed `reason` field instead of
+    // grepping stderr for 'not found'.
+    assert.strictEqual(result.reason, GRAPHIFY_REASON.ENOENT);
   });
 
   test('returns exitCode 124 on timeout', () => {
@@ -199,7 +203,9 @@ describe('execGraphify', () => {
 
     const result = execGraphify('/tmp', ['build']);
     assert.strictEqual(result.exitCode, 124);
-    assert.ok(result.stderr.includes('timed out'));
+    // Migrated #2974: typed reason instead of stderr grep.
+    assert.strictEqual(result.reason, GRAPHIFY_REASON.TIMEOUT);
+    assert.strictEqual(result.timeout_ms, 30000);
   });
 
   test('passes PYTHONUNBUFFERED=1 in env', () => {