fix(docs-audit): scope the dot-directory prune premise to the files the walk collects

`walkSourceFiles` prunes every dot-directory under `packages/**` as build
residue, and `--self-test` re-measures the premise that makes that safe rather
than quoting it. The premise was stated over ALL tracked files, but the walk
collects `.ts` and nothing else, so it was strictly stronger than the property
the prune rests on.

The blank project template now commits `.github/workflows/ci.yml` — a template
asset this audit has never had a reason to read — which reds the pin while the
prune's actual safety is untouched. A false positive about a real premise is
the shape most likely to get a good pin deleted, so the measurement is scoped to
the extension the walk collects and stays armed for the first tracked `.ts`
under a dot-directory, which is the case the comment describes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PbJ5Cy9KDAzeQHo8bsMadG

Author: claude

.changeset/scaffold-blank-template-ci-workflow.md

@@ -0,0 +1,18 @@
+---
+"create-objectstack": minor
+---
+
+Scaffolded projects now ship a CI workflow. The blank template carries
+`.github/workflows/ci.yml` — one job, on `push` and `pull_request`: checkout,
+pnpm, Node 22, `pnpm install --frozen-lockfile`, then `pnpm validate` and
+`pnpm typecheck`.
+
+The scaffolder already created `.github/` at runtime for a single file
+(`copilot-instructions.md`) while the template's gates shipped as npm scripts
+nothing ever ran, so a fresh project started with no CI at all — and ObjectStack
+metadata mistakes fail silently at runtime, which makes `objectstack validate`
+the only place they surface early. That gate is now unskippable for a human and
+for an AI agent authoring metadata in the project, instead of advisory.
+
+Existing projects are unaffected; copy the file from a fresh scaffold to adopt
+it.

scripts/docs-audit/affected-docs.mjs

@@ -2115,12 +2115,16 @@ function walkSourceFiles(root, readDir = readdirSync) {
       //
       // Naming the two (three) directories would fix today and leave the next emitted
       // tree to be discovered the same way, so the rule is the class. It is safe because
-      // it is MEASURED, not assumed: on `6b8c67778`,
-      //   git ls-files 'packages/**' | grep -cE '(^|/)\.[^/]+/'   →   0
-      // no TRACKED file under `packages/**` lives in a dot-directory at all, so this
-      // prunes residue and nothing else. That premise is not left to age quietly — the
-      // live pin in `--self-test` re-measures it on every run and reds the day a tracked
-      // source file appears under one.
+      // it is MEASURED, not assumed:
+      //   git ls-files 'packages/**' | grep -E '(^|/)\.[^/]+/' | grep -c '\.ts$'   →   0
+      // no TRACKED file this walk would COLLECT lives in a dot-directory, so this prunes
+      // residue and nothing else. The measurement is scoped to `.ts` because that is the
+      // only extension the walk collects: `packages/create-objectstack` commits a
+      // `.github/workflows/ci.yml` inside its bundled project template — a template asset
+      // this walk has never had a reason to read — and a premise stated over ALL tracked
+      // files reds on that while the prune's actual safety is untouched. That premise is
+      // not left to age quietly — the live pin in `--self-test` re-measures it on every
+      // run and reds the day a tracked SOURCE file appears under one.
       //
       // Applied to DIRECTORIES only: a dotfile that is somehow a `.ts` source is still
       // the file arms' business, not this one's.
@@ -5708,16 +5712,24 @@ function selfTest() {
     // (4) THE PREMISE OF THE DOT-DIRECTORY PRUNE (#15446 / #15457), RE-MEASURED rather
     // than quoted. `walkSourceFiles` prunes every dot-directory under `packages/**` as
     // build residue; that is a safe rule only while no TRACKED source lives in one —
-    // zero of them do, measured on `6b8c67778`. Written as a comment the measurement
-    // would age in silence and the walk would start dropping real source with nothing
-    // saying so. Asserted here it reds on the first tracked file under a dot-directory,
-    // and the remedy is then a choice made deliberately: move the file, or go back to
-    // pruning the residue trees by name.
+    // zero of them do. Written as a comment the measurement would age in silence and the
+    // walk would start dropping real source with nothing saying so. Asserted here it reds
+    // on the first tracked SOURCE file under a dot-directory, and the remedy is then a
+    // choice made deliberately: move the file, or go back to pruning the residue trees by
+    // name.
+    //
+    // Scoped to `.ts`, the only extension the walk collects, and NOT a weakening: the
+    // property the prune rests on is "nothing this walk would have collected is hidden by
+    // it", and a non-`.ts` file was never collectable. Stated over all tracked files the
+    // pin reds on a template asset — `packages/create-objectstack` commits
+    // `src/templates/blank/.github/workflows/ci.yml`, a file a scaffolded project needs
+    // and this audit has no interest in — which is a false positive about a real premise,
+    // the shape most likely to get a good pin deleted.
     const trackedDotDirFiles = sh('git ls-files packages')
       .split('\n')
-      .filter((f) => /(^|\/)\.[^/]+\//.test(f));
-    check('walkSourceFiles', 'no TRACKED file under packages/** lives in a dot-directory — the premise the prune rests on',
-      'git ls-files packages, filtered to dot-directories', 0, trackedDotDirFiles.length);
+      .filter((f) => /(^|\/)\.[^/]+\//.test(f) && f.endsWith('.ts'));
+    check('walkSourceFiles', 'no TRACKED .ts source under packages/** lives in a dot-directory — the premise the prune rests on',
+      'git ls-files packages, filtered to .ts under dot-directories', 0, trackedDotDirFiles.length);
   }
 
   // ── The floor: every declared battery RAN, and ran its cases (#13489) ───