chore: move scripts/graph out of the product repo

[pitimon]

scripts/graph/ is a SCIP code-graph indexer built for the maintainer's own agent tooling. It is not part of @ipv9/tokentracker-cli and ships to nobody.

It costs the product repo three things:

1. 12 of the repo's 118 test files — roughly a tenth of the suite, testing something users never run. That distorts every coverage judgement: the repo looks well tested while four product parsers (hermes, codebuddy, craft, kimi) have no test at all (test: parser conformance ratchet — cover the code that actually carries risk #104).
2. Time in every ci:local run, on every PR, for all contributors.
3. Review surface — anyone auditing this repo has to work out that it is unrelated before they can ignore it.

Proposal

Move it to its own repository. If it must stay for now, at minimum split it out of the default ci:local chain into a separate script so the product gate reflects the product.

Before removing

Check nothing in the product path imports it — grep -rn "scripts/graph" --include='*.js' --include='*.cjs' --include='*.json' . — and confirm no workflow or skill outside this repo depends on the path. If something does, note it in the destination repo's README rather than leaving the dependency implicit.

Priority

Lowest of the set. It is hygiene, not a defect, and worth doing on a quiet day rather than ahead of #100.

[pitimon]

The "at minimum" half is done in #115 (main @ dfb3ff7): test/graph-auto-index-*.test.js moved to test/graph/, out of npm test and ci:local. Product suite 909 -> 893 at the time, 902 now.

They still run, in their own workflow job triggered only on scripts/graph/** or test/graph/**. Deliberately a real blocking job rather than continue-on-error, since a gate that cannot fail reports success it did not earn.

The trade is recorded in the workflow file: a change elsewhere that breaks the indexer is caught on the next graph-touching PR rather than immediately. The tool has no runtime dependency on the product.

Still open: the move to its own repository. That needs a destination repo, which is a decision rather than a code change — leaving this issue open for it.

[pitimon]

Closing at the "if it must stay for now" half, by decision. scripts/graph/ stays in this repository; it is out of the product gate.

What the issue asked for, and what each half bought

The issue named three costs. Two of the three are closed by #115:

Cost named in this issue	Status
12 of 118 test files testing something users never run, distorting every coverage judgement	closed — they are in test/graph/, outside npm test and ci:local. Product suite is 924 root tests, none of them the indexer.
Time in every ci:local run, on every PR, for all contributors	closed — the graph job runs only when scripts/graph/** or test/graph/** changes.
Review surface: an auditor has to work out it is unrelated before ignoring it	partly — CONTRIBUTING.md now says what the directory is and why it is not in the product gate, which is the cheap version. The directory is still there.

The coverage-distortion point was the load-bearing one, because #104 depends on it: with the indexer out of the count, "four product parsers have no test at all" is a statement about the product rather than an artefact of what got counted.

Why not the full move

A separate repository buys the third row and nothing else, in exchange for a second repository to keep, release and secure. That is real ongoing cost against a one-line explanation in CONTRIBUTING.

It is also an outward-facing, hard-to-reverse action — creating a public repository and moving history into it — which is not something to do on inference.

If this is reopened later

The move is mechanical and the groundwork is done: nothing in the product imports scripts/graph (only the graph:auto-index and graph:scip npm scripts reference it), the tests are already isolated in test/graph/, and .github/workflows/graph-tools.yml is a self-contained job that would travel with it. About 48 KiB of source and 48 KiB of tests.

The one thing to preserve on a move is git history — git filter-repo or a subtree split rather than a copy, so the indexer's own history is not lost.

Not closed by this

Nothing else. #104's hermes fixture and the remaining allowlist entries are tracked there, not here.