fix(migration): remediate 6 MAJOR + 3 MINOR trekreview findings + stale rename test

MAJOR
- 9e97cd5 40-validate-standalone.sh: route a target's sc2_gate to its dedicated
  gate (config-audit → 50-config-audit-sc2.sh), mirroring 99-dryrun.sh, so --all
  no longer falsely FAILs config-audit on the machine-locked v5.0.0 tests.
- 1708e90 99-dryrun.sh: assert EXACTLY one tag survives (F5); a partial tag-strip
  no longer silently reports the wrong tag via head -1.
- 4e494c8 99-dryrun.sh: capture the SC2 standalone failing set from the dry-run's
  own prepped extract ($dest), not the 40-validate side-effect clean room.
- aeb6292 00-preflight.sh: assert every map path is whitespace/glob-free, making
  the word-split path handling in 99-dryrun.sh sound.
- 5d112cb extract the SC6 DROP + SC2 regression detectors into sc6-check.sh /
  sc2-regression.sh and add sc-checks.test.mjs — a negative test proving each
  detector FIRES (force-fresh re-extraction would undo a planted file-drop).
- 9e588ca 10-extract.sh re-asserts git filter-repo before use (self-heal runs
  preflight only on a missing mirror); RUNBOOK lists git-filter-repo + python3>=3.6.

MINOR
- bc0f8a7 plugin-map.json: reset ms-ai-architect blob_strip_safe to null
  (00-preflight.sh populates it per run).
- 8d649e9 99-dryrun.sh: gate SC6 behind extract success; a failed extract is
  labelled (extract failed), not a content DROP.
- 4044c49 99-dryrun.sh: guard mktemp — an empty capture is an error, not a
  false zero-regression PASS.

Also: 00-preflight.test.mjs asserted all 3 'renamed' plugins carry >=2 paths, but
llm-security became single-path in 836b8e9 (copilot was a coexisting plugin, not a
rename) — a stale pre-existing failure. Aligned the test to the ratified map and
added a positive single-path lock against re-introducing the 87-file-drop defect.

Verified: full dry-run 11/11, 0 pushes; sc-checks/99-dryrun/40-validate/00-preflight/
60-rewrite suites green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/marketplace-polyrepo-migration/migration/40-validate-standalone.sh

@@ -78,32 +78,45 @@ validate_target() {
     fi
   fi
 
-  # --- SC2: run the plugin's declared runner in the clean room ---
-  local test_cmd advisory
+  # --- SC2: route to the target's dedicated gate if it declares one, else run the declared runner in the
+  #     clean room. config-audit's full `node --test 'tests/**/*.test.mjs'` FAILs at a fresh-clone path on
+  #     the 6 machine-locked v5.0.0 byte-stability tests — the exact blocker its Step-7 gate resolves — so
+  #     `--all` MUST delegate to that gate (mirroring 99-dryrun.sh), not run the raw test_cmd. ---
+  local test_cmd advisory sc2_gate
   test_cmd="$(python3 -c "import json; print(json.load(open('$MAP'))['targets']['$key'].get('test_cmd',''))")"
   advisory="$(python3 -c "import json; print(json.load(open('$MAP'))['targets']['$key'].get('test_cmd_advisory',''))")"
-
-  # The generic structure validator (Step 7) is referenced by test-less plugins — vendor it into the clean room.
-  case "$test_cmd" in
-    *validate-plugin.generic.sh*)
-      if [ -f "$GENERIC_VALIDATOR" ]; then cp "$GENERIC_VALIDATOR" "$cr/validate-plugin.generic.sh"; fi
-      ;;
-  esac
+  sc2_gate="$(python3 -c "import json; print(json.load(open('$MAP'))['targets']['$key'].get('sc2_gate',''))")"
 
   local sc2_label="standalone-safe"
-  local out status tests
-  out="$(cd "$cr" && eval "$test_cmd" 2>&1)"; status=$?
-  if [ $status -ne 0 ]; then
-    problems="$problems; SC2 runner failed (exit $status)"
+
+  if [ -n "$sc2_gate" ]; then
+    if WORK="$WORK" bash "$SCRIPT_DIR/$sc2_gate" >/dev/null 2>&1; then
+      sc2_label="$sc2_gate, standalone-safe"
+    else
+      problems="$problems; SC2 gate failed ($sc2_gate)"
+    fi
+  else
+    # The generic structure validator (Step 7) is referenced by test-less plugins — vendor it into the clean room.
+    case "$test_cmd" in
+      *validate-plugin.generic.sh*)
+        if [ -f "$GENERIC_VALIDATOR" ]; then cp "$GENERIC_VALIDATOR" "$cr/validate-plugin.generic.sh"; fi
+        ;;
+    esac
+
+    local out status tests
+    out="$(cd "$cr" && eval "$test_cmd" 2>&1)"; status=$?
+    if [ $status -ne 0 ]; then
+      problems="$problems; SC2 runner failed (exit $status)"
+    fi
+    case "$test_cmd" in
+      *node\ --test*)
+        # Node 25's default reporter prints "ℹ tests N"; older/TAP prints "# tests N". Match either.
+        tests="$(printf '%s\n' "$out" | grep -oE 'tests [0-9]+' | grep -oE '[0-9]+' | tail -1)"
+        [ -n "$tests" ] && sc2_label="$tests tests, standalone-safe"
+        ;;
+      *validate-plugin*) sc2_label="structure, standalone-safe" ;;
+    esac
   fi
-  case "$test_cmd" in
-    *node\ --test*)
-      # Node 25's default reporter prints "ℹ tests N"; older/TAP prints "# tests N". Match either.
-      tests="$(printf '%s\n' "$out" | grep -oE 'tests [0-9]+' | grep -oE '[0-9]+' | tail -1)"
-      [ -n "$tests" ] && sc2_label="$tests tests, standalone-safe"
-      ;;
-    *validate-plugin*) sc2_label="structure, standalone-safe" ;;
-  esac
 
   if [ -n "$problems" ]; then
     echo "$key: FAIL${problems}"