ci(lint): run os-regen-merge's --self-test, mirroring the verify-lock step (#12944)

`scripts/pm/os-regen-merge.sh` ships a 23-case `--self-test` and nothing in
`.github/workflows/` ran it. The script itself has no CI path by design — it is
run by hand inside a feature branch's worktree, on a merge that exists only
there — but its self-test needs only `git` and a temp dir, and two of the 23
cases are source scans of the script's own text (step 2 must keep the
non-staging `git restore --source` spelling, never the staging `git checkout`
one) that a future refactor would invalidate in silence.

One step in the `Lint & Repo Gates` job, mirroring the existing
`Verify-lock entry-point self-test` step 1:1. Unconditional and un-`if:`-ed,
like every self-test around it. No job names change, so no required context
name changes.

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-litant

.github/workflows/lint.yml

@@ -1037,6 +1037,40 @@ jobs:
       - name: PM ci-failure self-test
         run: node scripts/pm/ci-failure.mjs --self-test
 
+      # os-regen-merge self-test (#12893). Mirrors the `Verify-lock entry-point
+      # self-test` step above 1:1 — same directory, same split between the tool
+      # and its self-test. `scripts/pm/os-regen-merge.sh` is the mechanized merge
+      # sequence for a branch touching os-regen-driven generated artifacts, and it
+      # has NO CI path at all: it is run BY HAND inside a feature branch's
+      # worktree, on a merge that exists only there. Its header says so, and that
+      # is deliberate.
+      #
+      # The SELF-TEST is a different animal from the script it tests. It needs no
+      # worktree, no remote and no merge — only `git` and a temp dir — and it
+      # builds five small fixture repos to pin 23 cases: the PER-FILE merge-side
+      # selection and its per-path notices, the staged-diff sentence, the
+      # uncommitted-hand-off refusal, and the four pre-existing refusals. A few
+      # seconds, no network.
+      #
+      # Left unwired it rots the way this repo has already recorded and fixed
+      # twice (#11514, #6008): the next refactor of the script reds nothing. Two
+      # of the 23 cases are SOURCE SCANS of the script's own text — they assert
+      # step 2 keeps the non-staging `git restore --source` spelling and never the
+      # staging `git checkout` one — which is to say they are precisely the rows a
+      # future edit invalidates silently and precisely the rows no reviewer reads.
+      # Nothing but this step is an instrument for them.
+      #
+      # Unconditional and un-`if:`-ed, like every self-test around it — an
+      # exemption is precisely what a self-test must not have, or the gap simply
+      # moves. One `--self-test` per `run:` block, deliberately: the masking shape
+      # `check-step-collectors.mjs` guards is a block driving TWO OR MORE distinct
+      # scripts. A discovery collector over `scripts/pm/*.sh --self-test` — which
+      # would also catch the next such script arriving unwired — is ruled out of
+      # this card: two literal steps do not yet justify the machinery, and a third
+      # is when to revisit it.
+      - name: os-regen-merge self-test
+        run: bash scripts/pm/os-regen-merge.sh --self-test
+
       # Claude hook guard self-tests (#11514, objectstack half of
       # objectstack-ai/objectui#5754). `.claude/hooks/` holds the enforcement
       # behind the two rules whose violation is most expensive in this repo —