fix(isISO6346): anchor the pattern and reject a literal comma

[yfwmaniish]

Closes #2772.

Bug

isISO6346 (and its alias isFreightContainerID) accepts malformed strings because its regex has two flaws:

const isISO6346Str = /^[A-Z]{3}(U[0-9]{7})|([J,Z][0-9]{6,7})$/;

1. Unanchored alternation. The | splits the whole pattern, so ^ anchors only the first branch and $ only the second. Anything starting with [A-Z]{3}U + 7 digits matches regardless of trailing junk, and anything ending with [JZ] + 6-7 digits matches regardless of leading junk.
2. Literal comma in the class. [J,Z] matches J, Z, or ,.

Inputs whose length isn't 11 skip the checksum and return true, so malformed strings pass:

isISO6346('HLXU2008419HELLO'); // true  ❌ (trailing junk)
isISO6346('QJR,123456');       // true  ❌ (literal comma)

Fix

Group the alternation under the shared ^[A-Z]{3} prefix and end anchor, and drop the stray comma:

const isISO6346Str = /^[A-Z]{3}(?:U[0-9]{7}|[JZ][0-9]{6,7})$/;

Tests

Added trailing-junk, leading-junk, and literal-comma cases to the invalid list. Verified against the full existing suite: all 10 valid IDs (incl. the QJRZ123456 J/Z 6-digit case) stay valid and all invalid IDs (incl. the 3 new ones) are rejected.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (a79ff98) to head (a972b6a).

Additional details and impacted files

@@            Coverage Diff            @@
##            master     #2877   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2599      2599           
  Branches       658       658           
=========================================
  Hits          2599      2599           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nrps9909]

Validated exact head a972b6a85df21386f09f46fc054402d15f5c05e9 against base a79ff980ab14257e795332989e497bdff3218e87.

• Applying the PR test file to the unchanged base makes the focused ISO6346 test fail on HLXU2008419HELLO as expected. Head full npm test passes 323 tests, generated builds, and ESLint (Node 24.15.0).
• An independent positional-shape/checksum oracle covers 14,466 unique inputs per API per form: both isISO6346 and isFreightContainerID, across source, Node, browser, and minified browser. Base has 4,349 false accepts per API/form; head has zero mismatches. Controls cover U/J/Z, existing lowercase acceptance, optional J/Z check digits, all decimal check-digit substitutions for generated prefixes, commas, prefixes/suffixes, whitespace, line terminators, and NUL.
• All 13 exposed upstream checks pass.

The grouping and comma removal resolve the reported malformed-input paths while preserving the existing optional J/Z checksum contract. This is a scoped syntax/checksum review; it does not validate owner-code registration or claim exhaustive ISO conformance.