ci: two test:ci drift checks are never executed by any GitHub Actions job

[phamngocquy]

Summary

.github/workflows/ci.yml runs each drift check as its own path-gated step — db:migrations:check (line 302),
db:schema-drift:check (308), docs:drift-check (357), dead-source-files:check (372),
regate-sort-key:check (378), branding-drift:check (410), and so on. Several of those steps carry the same
comment: "Same local-only-until-now gap as the drift checks above: nothing in this workflow previously ran it,
so the two could silently diverge with zero CI signal."

Two checks in package.json's test:ci still have that gap:

1. coco-dev-versions:check → scripts/check-coco-dev-versions.ts. Its own header states it is "wired
   into npm run test:ci so a version bump made in only one of the two files (k8s/coco-dev/versions.json,
   k8s/coco-dev/kbs/base/kustomization.yaml) fails CI instead of silently shipping a KBS deploy that doesn't
   match its own recorded version manifest." No CI job runs it. Its only test,
   test/unit/check-coco-dev-versions-core.test.ts, exercises the pure core against fabricated inputs and
   never reads the two real files. .github/workflows/ contains no reference to k8s at all, so no path
   filter would trigger such a job either.
2. import-specifiers:check → scripts/check-import-specifiers.ts (scripts: unify relative-import specifiers with src/** (extensionless) and add a drift guard #9221). No CI job runs it, and
   test/unit/check-import-specifiers-script.test.ts is entirely injection-based
   (listSourceFiles/readFile fakes) with no assertion against the real tree — unlike its sibling
   test/unit/check-coverage-bolt-on-filenames-script.test.ts:51 ("the real repo has zero coverage bolt-on
   filenames (regression guard)") and test/unit/validate-no-hand-written-js.test.ts:80-82 ("The real gate,
   run against the real tree"), both of which close the same gap for their own checks. This is not theoretical:
   chore(imports): packages/loopover-ui-kit drifted from #9221's extension convention (introduced by #9239) #9240 and chore(imports): test/unit/engine-coverage-script.test.ts drifted from #9221's extension convention (introduced by #9245) #9249 are two separate drifts that landed after scripts: unify relative-import specifiers with src/** (extensionless) and add a drift guard #9221 shipped the guard.

Every other entry in test:ci that has no explicit ci.yml step is covered another way — the contract/parity
suites and validate:mcp run inside the main vitest job, the ui:* and build* scripts run via npx turbo
steps, and coverage-boltons:check / validate:no-hand-written-js are enforced by their real-tree tests
above. These two are the only ones with no enforcement path at all.

Deliverables

• .github/workflows/ci.yml changes job declares a cocoDev filter output covering k8s/coco-dev/**
  and scripts/check-coco-dev-versions*.ts.
• .github/workflows/ci.yml has a named step running npm run coco-dev-versions:check, gated on that
  filter plus the push clause.
• .github/workflows/ci.yml has a named step running npm run import-specifiers:check, gated as specified
  above.
• test/unit/check-import-specifiers-script.test.ts contains a real-tree regression test that calls
  findImportSpecifierViolations() with NO injected listSourceFiles/readFile and asserts the result is
  [], with a comment naming chore(imports): packages/loopover-ui-kit drifted from #9221's extension convention (introduced by #9239) #9240/chore(imports): test/unit/engine-coverage-script.test.ts drifted from #9221's extension convention (introduced by #9245) #9249 as the drifts that reached main while the guard was local-only.
• npm run actionlint and npm run lint:composite-actions pass on the edited workflow.

All Deliverables above are required in a single PR. A PR that satisfies only some of them — for example adding
the two workflow steps but skipping the real-tree test in Deliverable 4 — does not resolve this issue.

Test plan

.github/workflows/** and scripts/** are OUTSIDE Codecov's coverage.include (which covers src/**,
packages/loopover-engine/src/**, packages/loopover-miner/{lib,bin}/**, packages/discovery-index/src/**,
packages/loopover-contract/src/** and packages/loopover-mcp/{lib,bin}/**), so Codecov's patch gate does not
apply to the workflow edit or to scripts/check-import-specifiers.ts. Real tests are still required:
Deliverable 4 is a genuine vitest assertion against the real tree, not a placeholder. Do not add no-op or
expect(true) tests to satisfy the checkbox.

Fixes #9649

[loopover-orb]

Important

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏳ LoopOver is waiting…

LoopOver has seen this pull request and is waiting on CI checks to finish before reviewing it. This comment will update once the review runs.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟨 Waiting}

[superagent-security]

Superagent Supply Chain Scan

Superagent flagged 1 dependency introduced by this pull request.

High risk: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9

• Change: added 55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• Dependency path: .github/workflows/ci.yml → jobs → validate-code → steps → 24 → actions/cache/restore
• Correlated risks: 3
• Why flagged: Detects keylogging and input capture patterns. Location: cache-55cc8345863c7cc4c66a329aec7e433d2d1c52a9/dist/restore-only/index.js. Rules: threat-runtime-keylogging
• Risk score: 4.9

View Superagent Supply Chain Scan

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

This repository reviews pull requests one-shot: the PR must be correct as originally opened. Pushing an additional commit closes it automatically instead of restarting review — open a fresh pull request with every fix included.