fix: round 3 of the release review of 6.3.0

Round 3 (v6.2.0..96cb977, BLOCK: 1 BLOCKER, 8 MAJOR, 2 MINOR), each fixed
behind a test that failed first.

- Every allowlisted runner, not only git, takes plain words and a short list
  of options that only read: an option that writes a file or loads code
  (--test-reporter-destination, --outputFile, --junitxml, --basetemp,
  --import, --config, -p, -o, -exec, a reporter path) is on no list; after
  `npm test --` only paths follow; `make test` takes no VAR=value. A built-in
  node test reporter (tap, spec, dot, junit, lcov) stays allowed.
- /trekexecute: a restore the guard refuses (destructive git, in the mode
  that shows no prompts) or the operator declines is never recorded as
  reverted: simplify = "revert-refused" and the run stops before review; a
  refused step revert is reported with its paths.
- stepTestsOnly: a fixture document under tests/ is a test file, "e.g." is
  not a path, ./ is dropped; the plan-file sweep reads Files: with the same
  reader (fieldPaths); the validator hands its parsed fields over.
- plan-validator --steps-from asks for Verify: on a 1.8 plan too.
- skill frontmatter: a value starting with # is a hazard; a quote after an
  escaped backslash closes the value. Routing reads kind tags with hasOwn.
- release-check reads scope_sha_end as written (an all-digit sha keeps its
  leading zero), and Voyage's own artifacts under .claude/projects/ and
  .claude/voyage/ committed after the review do not count as unreviewed.

Suite 2170 (2168/0/2).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/scripts/release-check.test.mjs

@@ -126,7 +126,10 @@ function fixture({
   git(dir, 'commit', '-q', '-m', 'chore(release): fixture');
 
   if (afterRelease) {
-    for (const [rel, text] of Object.entries(afterRelease)) writeFileSync(join(dir, rel), text);
+    for (const [rel, text] of Object.entries(afterRelease)) {
+      mkdirSync(dirname(join(dir, rel)), { recursive: true });
+      writeFileSync(join(dir, rel), text);
+    }
     git(dir, 'add', '-A');
     git(dir, 'commit', '-q', '-m', 'after the review');
   }
@@ -388,3 +391,23 @@ test('release-check — a flag with no value is exit 2, not 1', () => {
   assert.equal(r.status, 2, r.stdout + r.stderr);
   assert.match(r.stdout + r.stderr, /not measured|NOT MEASURED/i);
 });
+
+// ==== round 3 of the release review of 6.3.0 (2026-10-10) ====================
+
+test('release-check r3 — the review and the approval log committed after the review do not count as unreviewed → 0', () => {
+  const fx = fixture({ afterRelease: {
+    '.claude/projects/2026-10-08-s/review.md': 'the review, committed (artifact_store: git)\n',
+    '.claude/voyage/approvals.jsonl': '{"kind":"release"}\n',
+  } });
+  try {
+    const r = run(fx);
+    assert.equal(r.status, 0, r.stdout + r.stderr);
+  } finally { fx.cleanup(); }
+});
+
+test('release-check r3 — scope_sha_end is read as written: an all-digit sha keeps its leading zero', () => {
+  assert.equal(typeof mod.reviewedSha, 'function');
+  assert.equal(mod.reviewedSha('---\ntype: trekreview\nscope_sha_end: 0123456\n---\nbody\n'), '0123456');
+  assert.equal(mod.reviewedSha('---\nscope_sha_end: "00ab12"\n---\n'), '00ab12');
+  assert.equal(mod.reviewedSha('---\ntype: trekreview\n---\nscope_sha_end: 1\n'), '', 'only the frontmatter counts');
+});