fix(engine): TAG-ANNOTATED never consulted the register for the newest tag

Reported by catalog (coord, 2026-08-17): register/repos.json has listed
ktg-plugin-marketplace v7.7.2 under tags_lightweight_accepted since the
0.11.2 release (2026-08-14), but `accepted` was only ever applied to
tags.slice(0, -1) — the newest tag is excluded from that slice by
construction, so the entry was dead weight from the day it was written.

checkTagIntegrity now checks the newest tag against `accepted` too, emitting
a distinct TAG-ANNOTATED-ACCEPTED-NEWEST OK instead of silently doing
nothing when the register names it exactly. Acceptance is per-tag-name, not
a standing exemption: a new lightweight tag that becomes newest afterwards
is still judged (tested).

TDD: two new tests written failing first (an existing test's title claimed
"cannot be accepted away" but never actually passed a matching `name`, so it
was accidentally still green either way — reworded to test what it actually
covers). Verified against a fresh clone of ktg-plugin-marketplace: the full
finding set now reads OK TAG-ANNOTATED-ACCEPTED-NEWEST + OK
TAG-ANNOTATED-ACCEPTED(7 older) instead of ERROR, with no knock-on effect on
TAG-SIGNED (all 9 tags predate the signing policy). Register comment updated
to record the three-day dead-weight window rather than silently correcting
it — a decision that turns out wrong is worse than no record.

247 tests pass (245 + 2 new).

scripts/repo-standard-check.test.mjs

@@ -903,15 +903,54 @@ test('an unaccepted lightweight tag still fires, and the WARN counts only the un
 });
 
 // The newest tag is what a consumer resolves today and what an operator can
-// re-cut at no cost. It is the one lightweight tag with a safe remedy, so it
-// is the one that cannot be accepted away.
-test('the NEWEST lightweight tag is still an ERROR even when the register accepts its name', () => {
-  const reg = { tags_lightweight_accepted: { alpha: ['v2.0.0'] } };
-  const f = checkTagIntegrity({ tagObjects: [{ name: 'v1.0.0', annotated: true }, { name: 'v2.0.0', annotated: false }] }, reg);
+// re-cut at no cost, so acceptance is never inherited from a repo merely
+// having OTHER accepted entries — only an exact name match on THIS tag excuses
+// it (the exception directly below).
+test('an unaccepted newest lightweight tag is still an ERROR, even when the register has other entries for this repo', () => {
+  const reg = { tags_lightweight_accepted: { alpha: ['v9.9.9'] } };
+  const f = checkTagIntegrity({ tagObjects: [{ name: 'v1.0.0', annotated: true }, { name: 'v2.0.0', annotated: false }], name: 'alpha' }, reg);
   const hit = f.find((x) => x.code === 'TAG-ANNOTATED');
   assert.equal(hit.level, 'ERROR');
 });
 
+// A tag that sorts "newest" by version string without being the newest
+// RELEASE — a monorepo-era tag predating a split, consumed by nothing — has a
+// real safe remedy (`git tag -a -f`, same commit) that still costs more than
+// the finding when nothing resolves it. The register names the tag by EXACT
+// NAME, never "this repo's newest is always excused" — caught the moment
+// `ktg-plugin-marketplace v7.7.2` was found dead weight: the register had
+// accepted it since 2026-08-14 (repos.json `tags_lightweight_accepted`) but
+// `accepted` was only ever consulted for tags OLDER than newest, so the
+// recorded decision could never take effect. Reported by the catalog
+// (coord, 2026-08-17): measured against the real register and real tag data,
+// exactly two findings — ERROR TAG-ANNOTATED on the (then-)inert acceptance,
+// OK TAG-ANNOTATED-ACCEPTED for the 7 older accepted tags.
+test('the newest lightweight tag IS excused when the register names it exactly, with a distinct OK code', () => {
+  const reg = { tags_lightweight_accepted: { alpha: ['v2.0.0'] } };
+  const f = checkTagIntegrity({ tagObjects: [{ name: 'v1.0.0', annotated: true }, { name: 'v2.0.0', annotated: false }], name: 'alpha' }, reg);
+  assert.equal(f.some((x) => x.code === 'TAG-ANNOTATED'), false);
+  const ok = f.find((x) => x.code === 'TAG-ANNOTATED-ACCEPTED-NEWEST');
+  assert.equal(ok.level, 'OK');
+  assert.match(ok.msg, /v2\.0\.0/);
+});
+
+// Acceptance names ONE tag, not a standing exemption for "whatever is newest".
+// A real new tag cut after the accepted one is still judged the moment it
+// becomes newest and isn't itself on the list — exactly what the register's
+// own comment promises: "a new lightweight newest tag is not on this list and
+// fires ERROR".
+test('a NEW lightweight tag cut after an accepted newest is still judged', () => {
+  const reg = { tags_lightweight_accepted: { alpha: ['v2.0.0'] } };
+  const f = checkTagIntegrity({ tagObjects: [
+    { name: 'v1.0.0', annotated: true },
+    { name: 'v2.0.0', annotated: false },
+    { name: 'v3.0.0', annotated: false },
+  ], name: 'alpha' }, reg);
+  const hit = f.find((x) => x.code === 'TAG-ANNOTATED');
+  assert.equal(hit.level, 'ERROR');
+  assert.match(hit.msg, /v3\.0\.0/);
+});
+
 test('acceptance is per repo — a name accepted for one repo does not excuse another', () => {
   const tagObjects = [{ name: 'v0.1.0', annotated: false }, { name: 'v1.0.0', annotated: true }];
   const f = checkTagIntegrity({ tagObjects, name: 'beta' }, ACCEPT_REG);