fix(engine): close the linked-badge blind spot, de-tautologize 2 tests

Two remaining minor findings from STATE.md:

checkBadges treated being wrapped in a markdown link as proof of a
real run and skipped BADGE-STATIC-CLAIM entirely — but nothing ever
checked the link actually resolved. The link-target capture group was
missing from the regex outright. Now a linked run-claim badge with a
relative target is resolved against `present` (new BADGE-DEAD-LINK,
ERROR/broken): a dead link is worse than a static badge because it
looks verified. External targets (the ordinary case — a CI provider)
still need the network and stay out of scope, same precedent as
checkInternalLinks.

The "four pre-existing tautological tests" note undercounted on
re-measurement: only two exist ('no class requires a ROADMAP', 'CONTRIBUTING
and CODE_OF_CONDUCT are required by no class'). Both read
`required_files` off the test file's OWN local REGISTER fixture, so
they could only ever check the fixture against itself — a typo in the
real register/repos.json would drift past them silently. Switched
both to `loadRegister()` and verified the fix is real: temporarily
added ROADMAP.md to a class in the live register and confirmed the
test goes red, then restored it clean.

113 -> 116 tests.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W1ZJFViVYpr8cvf4fs91j1

scripts/repo-standard-check.test.mjs

@@ -33,6 +33,7 @@ import {
   fetchWithRetry,
   headerLine,
   withEngineVersion,
+  loadRegister,
 } from './repo-standard-check.mjs';
 
 const REGISTER = {
@@ -374,9 +375,14 @@ test('required files are per class, not flat across the org', () => {
   assert.equal(missing.some((f) => f.code === 'FILE-MISSING' && f.msg.includes('LICENSE')), true);
 });
 
+// Was tautological: it read `required_files` off the test's OWN local
+// REGISTER fixture, so it could only ever check that this file agreed with
+// itself — a typo in the real register/repos.json would drift silently past
+// it. Reading the live register makes it an actual regression guard.
 test('no class requires a ROADMAP — it is 0/18 and belongs to a later step', () => {
-  for (const klass of Object.keys(REGISTER.classes)) {
-    assert.equal(REGISTER.classes[klass].required_files.includes('ROADMAP.md'), false);
+  const live = loadRegister();
+  for (const klass of Object.keys(live.classes)) {
+    assert.equal(live.classes[klass].required_files.includes('ROADMAP.md'), false);
   }
 });
 
@@ -560,6 +566,34 @@ test('a build badge that links to a real run is fine', () => {
   assert.equal(checkBadges({ readme }).filter((f) => f.level !== 'OK').length, 0);
 });
 
+// The gap: being LINKED was treated as proof of a real run, but nothing ever
+// checked that the link actually went anywhere. A badge linked to a dead
+// relative path is a claim dressed as evidence that LOOKS more credible than
+// a static one, not less. External targets (the ordinary case — a CI
+// provider) still need the network and stay out of scope, same as
+// checkInternalLinks.
+test('a linked badge whose relative target does not exist is a finding, not silently fine', () => {
+  const readme = '[![Tests](https://img.shields.io/badge/tests-passing-green)](docs/ci-results.md)';
+  const f = checkBadges({ readme, present: ['README.md'] });
+  assert.equal(f.some((x) => x.code === 'BADGE-DEAD-LINK'), true);
+  const hit = f.find((x) => x.code === 'BADGE-DEAD-LINK');
+  assert.equal(hit.level, 'ERROR');
+  assert.equal(hit.bucket, 'broken');
+});
+
+test('a linked badge whose relative target exists is fine', () => {
+  const readme = '[![Tests](https://img.shields.io/badge/tests-passing-green)](docs/ci-results.md)';
+  const f = checkBadges({ readme, present: ['README.md', 'docs/ci-results.md'] });
+  assert.equal(f.some((x) => x.code === 'BADGE-DEAD-LINK'), false);
+});
+
+test('a linked badge with no `present` given is not falsely flagged dead — external targets stay unverifiable', () => {
+  // Guards the call site: checkBadges must still tolerate being called
+  // without `present`, same as checkInternalLinks tolerates it.
+  const readme = '[![CI](https://forge.example/repo/badges/workflows/ci.yml/badge.svg)](https://forge.example/repo/actions)';
+  assert.equal(checkBadges({ readme }).some((x) => x.code === 'BADGE-DEAD-LINK'), false);
+});
+
 // Reported by llm-ingestion-pipeline-security (coord, 2026-08-03): a bare
 // `status` badge is a self-declared maturity label ("alpha", "experimental"),
 // the same class as version/licence/platform, which already assert no run —
@@ -774,9 +808,12 @@ test('the security trait requires limitations to be stated', () => {
   assert.equal(f.some((x) => x.code === 'HEADING-MISSING' && x.msg.includes('Known limitations')), true);
 });
 
+// Same fix as the ROADMAP test above: was checking the test's own fixture
+// against itself. Reading the live register makes it a real guard again.
 test('CONTRIBUTING and CODE_OF_CONDUCT are required by no class — the maintainer works alone', () => {
-  for (const klass of Object.keys(REGISTER.classes)) {
-    const req = REGISTER.classes[klass].required_files;
+  const live = loadRegister();
+  for (const klass of Object.keys(live.classes)) {
+    const req = live.classes[klass].required_files;
     assert.equal(req.includes('CONTRIBUTING.md'), false);
     assert.equal(req.includes('CODE_OF_CONDUCT.md'), false);
     assert.equal(req.includes('MAINTAINERS.md'), false);