fix(ci): stop the ci-failure self-test minting a failure annotation on green runs (#12018)

`scripts/pm/ci-failure.mjs --self-test` printed a line of prose that named a
workflow-command token literally, inside backticks, documenting what the tool
anchors on. The Actions runner does not know a token is being quoted: it parsed
it and minted `annotation_level: failure` on a check run whose conclusion was
SUCCESS. Measured on `d63b01436` (check-run 97678882948, `Lint & Repo Gates`),
that artifact was the ONLY annotation the run carried, and the step has no `if:`
and the workflow no `paths:` filter, so it fired on every pull request.

Two facts measured on real runs shape the fix and the gate:

  * the legacy `##[...]` form is parsed ANYWHERE in a printed line -- the token
    sat at column 18 and was still consumed, with everything before it dropped
    and the rest of the line taken as the message;
  * the `::...::` form is parsed only at LINE START -- two mid-sentence ones
    print on every PR from `check-prerelease-pin-watch` and mint nothing.

The prose is reworded so the printed bytes carry no token; splitting the JS
string would have changed nothing, because the runner reads the printed line.

`scripts/check-self-test-workflow-commands.mjs` closes the class rather than the
instance: it runs the self-tests CI runs and scans their real stdout, so the
question "is this token printed?" is answered by printing it rather than by a
rule about source. A static prefilter only selects which to run, which keeps the
step at ~14s against the ~4min the whole population costs. A sweep of all 128
found exactly one live site; the two inert ones redden the moment they move.


Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

.github/workflows/lint.yml

@@ -788,6 +788,49 @@ jobs:
           node scripts/check-self-test-wired.mjs --self-test
           node scripts/check-self-test-wired.mjs
 
+      # Self-test output vs. the runner's command parser (#11886). Sibling of
+      # the step above and sharing its population: that one asks whether CI RUNS
+      # each self-test, this one asks what each self-test PRINTS while it does.
+      #
+      # The defect it closes was live on every PR in this repo. A line of
+      # `scripts/pm/ci-failure.mjs`'s self-test prose named a workflow-command
+      # token literally, inside backticks, as documentation of what that tool
+      # anchors on. The runner does not know a token is being quoted: it parsed
+      # it and minted `annotation_level: failure` on a check run whose
+      # conclusion was SUCCESS. On `d63b01436` that artifact was the ONLY
+      # annotation the `Lint & Repo Gates` run carried. A failure-level
+      # annotation on a green required check is a claim that something failed,
+      # and a repo that mints one on every PR is teaching its readers to skim
+      # exactly the surface other gates report findings into.
+      #
+      # ⚠️ INVISIBLE TO EVERY LOCAL RUN, which is the whole reason it is a gate:
+      # the text is ordinary prose on disk and in a terminal, and only a runner
+      # transforms it. It was found by reading one job's annotations through the
+      # API, not by anything in this file.
+      #
+      # Two facts were measured on real runs and the gate's shape follows them:
+      # the legacy `##[...]` form is parsed ANYWHERE in a printed line (the
+      # measured token sat at column 18 and was still consumed), while the
+      # `::...::` form is parsed only at LINE START (two mid-sentence ones print
+      # on every PR from `check-prerelease-pin-watch` and mint nothing). So the
+      # first detector is unanchored and the second is anchored — flagging inert
+      # prose would be a false positive the next author would be right to delete.
+      #
+      # It RUNS the self-tests rather than reasoning about their source, because
+      # "is this token printed?" is only answerable by printing it. A static
+      # prefilter picks which ones to run — over-selecting freely, since the
+      # verdict never comes from it — which is what keeps this step at ~14 s
+      # instead of the ~4 min the whole population costs.
+      #
+      # Invoked as `node scripts/…` rather than through a `pnpm check:*` alias:
+      # see the GATE INVOCATION IDIOM note at the top of this file. Reads
+      # `scripts/` and `.github/workflows/` off disk and spawns the selected
+      # self-tests; no network.
+      - name: Self-test workflow-command gate
+        run: |
+          node scripts/check-self-test-workflow-commands.mjs --self-test
+          node scripts/check-self-test-workflow-commands.mjs
+
       # Verify-lock entry-point self-test (#9661). `scripts/pm/os-verify-lock.sh`
       # is the ONE way an agent takes the container's shared heavy-verify lock,
       # and it is the enforcement of a rule that used to live only in prose: the