Resolve TypeScript-authored gates in the dispatch derivation (#12247)

* fix(pm): resolve TypeScript-authored gates in the dispatch derivation

`resolveCheckToFiles` matched only `.mjs|.cjs|.js|.sh`, so every gate whose npm
script names a `.ts`/`.mts`/`.cts` file resolved to zero files. `discoverFamilies`
never opened the source, so those families contributed no watch hints, no
first-party import following, no `no-path-population` read, and no `gateFiles`
entry -- and scored `undetermined` for every card, indistinguishable from a gate
whose author declined to declare a population.

Three changes, all in the derivation:

- widen the extension alternation to `ts|mts|cts`;
- resolve a package manifest's spelling against the manifest's OWN directory
  (`dir`), so a script that climbs out of its package
  (`tsx ../../scripts/check-exported-any-returns.mts`) normalises to the tracked
  repo path instead of being misattributed to the package;
- anchor the alternation on its right, so an extension that is a prefix of a
  longer one (`.tsx`, `.json`) no longer matches as itself.

Measured on this tree, both directions, in the docblock: 73278 -> 74481
watch-hint (gate, file) pairs (+1203, 0 lost), zero-file families 24 -> 1,
19 families gaining coverage, 0 losing, 0 import-follow edges suppressed,
0 inherited hints lost, 0 gate files naming a path that does not exist.

The one family left zero-file, `check:app-nav-i18n`, is a `pnpm --filter ... run`
composite that names no path at all; no extension list can reach it, and the
self-test asserts the residue is only ever composites of that shape.

Part of #12107

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UjM2ia8Av1v5NqfqQEQmC6

* fix(pm): record the two skills bare-root verdicts the TS gate fix surfaces

Resolving TypeScript-authored gates un-voids the bare-root sweep for their
sources, which is what the card asked for -- that sweep walks the gate sources
`discoverFamilies` resolves, so a TypeScript gate was never swept. Two genuinely
invisible bare roots come with it, both `SKILLS_DIR = 'skills'`.

Both recorded REFUSE-UNSPELLABLE, on consistency with the existing
`check-skills-token-ratchet.mjs SKILLS_DIR skills` row directly above them: the
same bare root, the same readdir-plus-named-file shape, the same scale (11 of 50
there, 12 of 50 here). One root answered one way.

Each `why` is measured from its own gate's filter and cites that gate's own
file:line -- neither borrows the other's numbers, which the map's docblock
forbids by name. They are not the same mechanism:

- check:skill-docs DOES enumerate the bare root (build-skill-docs.ts:221) and
  reconciles it against DISPLAY both ways, but :222 admits a child only if it
  carries SKILL.md -- so the population is a filename filter, not the root.
- check:skill-refs never reads the bare root at all: it iterates the authored
  SKILL_MAP and manages skills/<name>/references/. Its true population,
  skills/*/references/**, collapses to a double slash (#12246), which is what
  leaves the bare root as the only spellable claim.

bare-root-worklist --self-test: 45 live row(s), 39 recorded verdict(s) -- none
stale, none missing.

Part of #12107

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UjM2ia8Av1v5NqfqQEQmC6

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: yinlianghui

scripts/pm/bare-root-worklist.mjs

@@ -303,6 +303,25 @@ const TRIAGE = new Map([
     why: 'one named file per child directory, 11 of 50 (22%). It already reaches its own cards '
       + 'through the artifact roster it names file by file, so the miss is smaller than the row',
   }],
+  ['check:skill-docs SKILLS_DIR skills', {
+    verdict: 'REFUSE-UNSPELLABLE',
+    why: 'one named file per child directory plus the root README — 12 of 50 (24%). '
+      + 'build-skill-docs.ts:221 readdirSync-es the bare root and reconciles the listing against '
+      + 'DISPLAY in both directions (:227-228), so a new or removed objectstack-*/SKILL.md moves '
+      + 'the verdict and no fixed list can name it; but :222 admits a child only if it CARRIES '
+      + 'SKILL.md, so the population is that filename filter, not the root. Recorded to match the '
+      + 'check-skills-token-ratchet row above, which reads the SAME root the same way at the same '
+      + 'scale — one root answered one way',
+  }],
+  ['check:skill-refs SKILLS_DIR skills', {
+    verdict: 'REFUSE-UNSPELLABLE',
+    why: 'a named subdirectory per child, enumerated and pruned wholesale — 12 of 50 (24%), 9 of '
+      + 'them the _index.md it emits. It never reads the bare root: build-skill-references.ts:304 '
+      + 'iterates the authored SKILL_MAP (:43-127), resolves skills/<name>/, and manages '
+      + 'skills/<name>/references/ via manageDir/ownsReferenceEntry (:288-294). The true population '
+      + 'is skills/*/references/**, which collapseHint reduces to skills//references/** — a double '
+      + 'slash no tree can hold (#12246) — so the only spellable claim left is the bare root',
+  }],
   ['check:runner-env-posture SCANNED_ROOTS packages', {
     verdict: 'REFUSE-UNSPELLABLE',
     why: 'non-test source beneath a `src` SEGMENT — 1794 of 5185 (35%). The segment is what makes '