feat(ms-ai-architect): Spor 3 Port 2 — create-time-guard (born-verified contract) [skip-docs]

Type-aware create-guard for reference-filer (Spor 3 Port 1/Port 2):

- kb-headers.mjs: parseTypeHeader/parseVerifiedHeader/parseVerifiedByHeader
  (samme top-500-byte bold-label-skann som parseSourceHeader).
- transform.mjs: buildKbHeader er type-aware (reference krever
  source+verified+verified_by; non-reference kaster pa MS-Learn-source) +
  emitterer Type/Verified/Verified by; validateKbFile type-aware;
  stampVerifiedMeta = fodt-verifisert-gate (stempler KUN ved bestatt
  judge-verdikt, ellers kaster).
- validate-kb-file.mjs (ny): kjorbar gate generatorer kaller for commit
  (exit != 0 ved kontraktbrudd).
- generate-skills.md + kb-update.md + transform-prompt.md: wiret til
  fodt-verifisert kontrakt (header-felt + judge-steg + create-guard-gate).

Suite 586/586 (33 nye + 1 invariant). Plugin-validering 239/0/0.

Utenfor scope (flagget): generate-skills.sh legacy (sonnet/Cosmo/no-source),
Cosmo-persona i generatorene (S-Cosmo), korpus-migrering av 306 filer (Spor 1).

tests/kb-eval/test-transform-criterion.test.mjs

@@ -19,7 +19,7 @@ import { readFileSync } from 'node:fs';
 import { dirname, join, basename } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { evalSkill } from '../../scripts/kb-eval/eval.mjs';
-import { composeKbFile, validateKbFile, resolveTargetPath } from '../../scripts/kb-update/lib/transform.mjs';
+import { composeKbFile, validateKbFile, resolveTargetPath, stampVerifiedMeta } from '../../scripts/kb-update/lib/transform.mjs';
 import { loadTaxonomy } from '../../scripts/kb-update/lib/taxonomy.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -71,16 +71,20 @@ test('regenerate 1 real file → valid, dated, source-anchored, body preserved,
   const category = parts[3];
   const filename = basename(refRel);
 
-  const regenerated = composeKbFile({
+  // Born-verified (Spor 3 Port 2): the regenerated file is stamped only after a passing
+  // judge verdict. Here the verdict is supplied directly (no LLM in this test) — the
+  // point is the regenerated file carries the full Port 1 contract (source + verified).
+  const stamped = stampVerifiedMeta({
     title: 'AI Foundry Disaster Recovery Planning',
     status: 'GA',
     category,
     source: 'https://learn.microsoft.com/azure/ai-foundry/concepts/disaster-recovery',
     lastUpdated: '2026-06',
-  }, body);
+  }, { pass: true }, '2026-06-29');
+  const regenerated = composeKbFile(stamped, body);
 
-  // Strictly better than the original: now valid (Source present + TOC for the large
-  // body), still dated. validateKbFile requires a TOC on large files, so valid:true
+  // Strictly better than the original: now valid (Source + Verified present + TOC for the
+  // large body), still dated. validateKbFile requires a TOC on large files, so valid:true
   // here is also the Fase 1c anti-regression proof.
   const v = validateKbFile(regenerated);
   assert.equal(v.valid, true, `regenerated file invalid: ${v.missing}`);