feat(ac-store): salvage ACs from closed PRs #113 and #1 (BO-2000, TQ-200)

[urlmonitor]

Summary

Re-authors the genuinely-valuable content from two PRs that were closed as unmergeable (stale, conflicting, and colliding on reassigned AC IDs), under fresh collision-free IDs via the canonical PO v3 → BA v3 → IT PO v3 flow (ADR-012).

All ACs are readiness: draft — queued for review; they will not be picked up by /build-ac until promoted to approved.

BO-2000-self-protecting-build (salvages #113)

Original #113 collided on the reassigned BO-1500 id. Re-authored as a new BO-2000 tree, explicitly disambiguated from BO-1700 (hook execution in worktrees) and BO-1500 (safe AC-authoring delivery):

• BO-2000a (KI-2) — self-hosting non-regression claims must be backed by a recorded command + captured zero-new-violations output; bare "verified" claims are rejected by the AC-fulfillment gates (ac-fulfillment-gate 11.7 / ac-validator 11).
• BO-2000b (KI-3) — builds must never run over an active worktree root (it clobbers tracked build-output and corrupts the diff); deploy is exercised against a disposable --target-dir outside the worktree; dual-tree files are edited in templates/ and compared, never build-synced.

TQ-200-tooling-coverage-recovery (salvages #1)

Recovers unit-test coverage for 9 currently-untested package-internal tooling modules: registry_validator (core + spawn bidirectionality), registry injection (injection_builders + template_compiler), package_audit, selection_criteria_evaluator, generate_agent_diagram, prioritize, scan_secrets.

⚠️ Open questions for review (from IT PO enrichment)

Several TQ-200 L2 criteria describe behavior that does not exist in the current code — decide whether to amend to pure coverage-recovery or expand scope:

• prioritize.py has no parked-ticket handling (_is_done only knows done/deferred).
• registry_validator has no missing-field / duplicate-id validation (missing id raises KeyError).
• selection_criteria_evaluator DSL has no negation operator.

And for BO-2000a: the evidence-bundle location is unspecified (sign-off comment vs. artifact file vs. AC field) — needs a BA decision before the gate rule can be written.

Test plan

• AC schema validation passes (check_ac_schema.py, exit 0).
• No AC-ID collisions (full-store scan loads all trees without duplicate-id error).
• Both trees under the 20-AC tree cap; parent covered_by lists wired.
• No code changes — AC-store only.

🤖 Generated with Claude Code