fix(migration): remediate 6 MAJOR + 3 MINOR trekreview findings + stale rename test

MAJOR
- 9e97cd5 40-validate-standalone.sh: route a target's sc2_gate to its dedicated
  gate (config-audit → 50-config-audit-sc2.sh), mirroring 99-dryrun.sh, so --all
  no longer falsely FAILs config-audit on the machine-locked v5.0.0 tests.
- 1708e90 99-dryrun.sh: assert EXACTLY one tag survives (F5); a partial tag-strip
  no longer silently reports the wrong tag via head -1.
- 4e494c8 99-dryrun.sh: capture the SC2 standalone failing set from the dry-run's
  own prepped extract ($dest), not the 40-validate side-effect clean room.
- aeb6292 00-preflight.sh: assert every map path is whitespace/glob-free, making
  the word-split path handling in 99-dryrun.sh sound.
- 5d112cb extract the SC6 DROP + SC2 regression detectors into sc6-check.sh /
  sc2-regression.sh and add sc-checks.test.mjs — a negative test proving each
  detector FIRES (force-fresh re-extraction would undo a planted file-drop).
- 9e588ca 10-extract.sh re-asserts git filter-repo before use (self-heal runs
  preflight only on a missing mirror); RUNBOOK lists git-filter-repo + python3>=3.6.

MINOR
- bc0f8a7 plugin-map.json: reset ms-ai-architect blob_strip_safe to null
  (00-preflight.sh populates it per run).
- 8d649e9 99-dryrun.sh: gate SC6 behind extract success; a failed extract is
  labelled (extract failed), not a content DROP.
- 4044c49 99-dryrun.sh: guard mktemp — an empty capture is an error, not a
  false zero-regression PASS.

Also: 00-preflight.test.mjs asserted all 3 'renamed' plugins carry >=2 paths, but
llm-security became single-path in 836b8e9 (copilot was a coexisting plugin, not a
rename) — a stale pre-existing failure. Aligned the test to the ratified map and
added a positive single-path lock against re-introducing the 87-file-drop defect.

Verified: full dry-run 11/11, 0 pushes; sc-checks/99-dryrun/40-validate/00-preflight/
60-rewrite suites green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/marketplace-polyrepo-migration/migration/99-dryrun.sh

@@ -49,6 +49,7 @@ mapget() { python3 -c "import json;print(json.load(open('$MAP'))['targets']['$1'
 mappaths() { python3 -c "import json;print(' '.join(json.load(open('$MAP'))['targets']['$1']['paths']))"; }
 
 # Live monorepo git-tracked file count across a target's source paths (SC6 baseline).
+# Paths are asserted whitespace- and glob-free by 00-preflight.sh (aeb6292), so the word-split below is sound.
 live_files() {
   local key="$1" total=0 p n
   for p in $(mappaths "$key"); do
@@ -110,7 +111,11 @@ for key in $KEYS; do
   commits=0; tag="(none)"; ext_files=0; sc7="clean"; sc6="?"
   if [ -d "$dest/.git" ]; then
     commits="$(git -C "$dest" rev-list --count HEAD 2>/dev/null || echo 0)"
-    tag="$(git -C "$dest" tag 2>/dev/null | head -1)"; tag="${tag:-(none)}"
+    # F5 invariant: 10-extract.sh strips all carried-over tags and re-creates EXACTLY one. Assert that —
+    # a partial tag-strip leaves multiple tags, and `head -1` would silently report the lexicographically
+    # -first wrong one (e.g. v1.0.0 instead of v5.1.1) while the dry-run still passed (1708e90).
+    tagn="$(git -C "$dest" tag 2>/dev/null | wc -l | tr -d '[:space:]')"
+    if [ "$tagn" = "1" ]; then tag="$(git -C "$dest" tag 2>/dev/null)"; else tag="(tags=$tagn!)"; ok=0; fi
     ext_files="$(git -C "$dest" ls-files | wc -l | tr -d '[:space:]')"
     leak="$(git -C "$dest" ls-files | grep -E 'STATE\.md|\.local\.md$' \
       | grep -v 'templates/okr\.local\.md\.template' || true)"
@@ -119,14 +124,16 @@ for key in $KEYS; do
     ok=0
   fi
 
-  # SC6 content retention. Intentional blob-strip targets may legitimately shed >1MB blobs, so a drop
-  # there is reported, not failed; for every other target a drop is a hard FAIL (the llm-security class).
+  # SC6 content retention — delegated to sc6-check.sh (the DROP detector, unit-tested in sc-checks.test.mjs).
+  # Only meaningful when the extract succeeded: a failed extract leaves ext_files=0, which must NOT be
+  # mislabelled as a content DROP (8d649e9) — emit (extract failed) instead. An intentional >1MB blob-strip
+  # target may legitimately shed blobs (reported, not failed); a shortfall elsewhere is a hard DROP (ok=0).
   lf="$(live_files "$key")"
   blob="$(mapget "$key" blob_strip)"
-  if [ "$ext_files" -lt "$lf" ]; then
-    if [ "$blob" = "True" ]; then sc6="${ext_files}/${lf} (blob-strip)"; else sc6="${ext_files}/${lf} DROP"; ok=0; fi
+  if [ -d "$dest/.git" ]; then
+    if sc6="$(bash "$SCRIPT_DIR/sc6-check.sh" "$ext_files" "$lf" "$blob")"; then :; else ok=0; fi
   else
-    sc6="${ext_files}/${lf}"
+    sc6="(extract failed)"
   fi
 
   # --- SC2 (regression-relative) ---
@@ -140,15 +147,27 @@ for key in $KEYS; do
     else
       case "$test_cmd" in
         *node\ --test*)
-          # Regression-relative: standalone failing set must be a subset of the in-repo failing set.
-          sf="$(mktemp)"; bf="$(mktemp)"
-          capture_fails "/tmp/claude-$key" "$test_cmd" > "$sf" 2>/dev/null
-          capture_fails "$REPO_ROOT/plugins/$key" "$test_cmd" > "$bf" 2>/dev/null
-          regr="$(comm -23 "$sf" "$bf")"
-          pre="$(wc -l < "$bf" | tr -d '[:space:]')"
-          rm -f "$sf" "$bf"
-          if [ -z "$regr" ]; then sc2="PASS (${pre} pre-existing)"; else
-            sc2="FAIL (regression: $(printf '%s' "$regr" | grep -c .))"; ok=0; fi
+          # Regression-relative: the standalone failing set must be a SUBSET of the in-repo failing set.
+          # Capture the standalone set from the dry-run's OWN prepped extract ($dest = $WORK/$key), NOT the
+          # 40-validate side-effect clean room /tmp/claude-$key (4e494c8 — that implicit coupling masked a
+          # real regression when the dir was absent). Guard mktemp: an empty capture is an ERROR, never a
+          # false zero-regression PASS (4044c49). The subset decision is delegated to sc2-regression.sh.
+          if sf="$(mktemp)" && bf="$(mktemp)"; then
+            capture_fails "$dest" "$test_cmd" > "$sf" 2>/dev/null
+            capture_fails "$REPO_ROOT/plugins/$key" "$test_cmd" > "$bf" 2>/dev/null
+            pre="$(wc -l < "$bf" | tr -d '[:space:]')"
+            if regr="$(bash "$SCRIPT_DIR/sc2-regression.sh" "$sf" "$bf")"; then
+              sc2="PASS (${pre} pre-existing)"
+            else
+              rc=$?
+              if [ "$rc" -ge 2 ]; then sc2="FAIL (sc2-regression error)"; else
+                sc2="FAIL (regression: $(printf '%s' "$regr" | grep -c .))"; fi
+              ok=0
+            fi
+            rm -f "$sf" "$bf"
+          else
+            sc2="FAIL (mktemp)"; ok=0; rm -f "$sf" "$bf"
+          fi
           ;;
         *) sc2="FAIL (structure)"; ok=0 ;;  # deterministic structure check genuinely failed
       esac