fix(ci): repair script smoke tests on main

Two failures landed this morning:

- test_gitleaks_ignore.py's historical-fingerprint resolution (added in
  d1fa7f38c) needs branch- and tag-reachable history, but the
  scripts-and-build job used a depth-1 checkout, so all 37 fingerprints
  failed to resolve in CI. Fetch full history like the gitleaks and
  changes jobs already do.

- d1f687c0e routed frontend-modern/package.json and package-lock.json to
  the new frontend-dependency-security path policy without updating the
  manifest expectations pinned in test-hot-dev-bg.sh. Pin the effective
  first-match policy per manifest instead of bare membership so the
  routing stays asserted and shadowed entries cannot fake coverage.

Contract-Neutral: CI-only fix: full-history checkout for gitleaks fingerprint resolution test and re-pin hot-dev manifest policy expectations to the registry routing d1f687c0e already established; no contract delta

.github/workflows/build-and-test.yml

@@ -225,6 +225,10 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          # test_gitleaks_ignore.py resolves historical fingerprints against
+          # branch- and tag-reachable commits, so it needs full history.
+          fetch-depth: 0
 
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0

scripts/tests/test-hot-dev-bg.sh

@@ -674,19 +674,26 @@ path_env = {
 go_mod = Path(os.environ["GO_MOD_PATH"]).read_text(encoding="utf-8")
 
 subsystem = next(item for item in registry["subsystems"] if item["id"] == "deployment-installability")
-policy = next(
-    item
-    for item in subsystem["verification"]["path_policies"]
-    if item["id"] == "dev-runtime-orchestration"
-)
+policies = subsystem["verification"]["path_policies"]
 owned = set(subsystem["owned_files"])
-matched = set(policy["match_files"])
+
+
+def effective_policy(path):
+    # First match wins, mirroring canonical_completion_guard.path_policy_matches.
+    for policy in policies:
+        prefixes = policy.get("match_prefixes", [])
+        if any(path == prefix.rstrip("/") or path.startswith(prefix) for prefix in prefixes) or path in policy.get(
+            "match_files", []
+        ):
+            return policy["id"]
+    return None
+
 
 for path in paths:
     exists = Path(os.environ[path_env[path]]).is_file()
     print(f"{path}:exists={exists}")
     print(f"{path}:owned={path in owned}")
-    print(f"{path}:policy={path in matched}")
+    print(f"{path}:policy={effective_policy(path)}")
     print(f"{path}:contract={f'`{path}`' in contract}")
 
 print(f"go.mod:uses_moby_api={'github.com/moby/moby/api' in go_mod}")
@@ -703,9 +710,17 @@ PY
     "frontend-modern/vite.config.ts" \
     "go.mod" \
     "go.sum"; do
+    case "${manifest_path}" in
+      frontend-modern/package.json | frontend-modern/package-lock.json)
+        expected_policy="frontend-dependency-security"
+        ;;
+      *)
+        expected_policy="dev-runtime-orchestration"
+        ;;
+    esac
     assert_contains "dev runtime manifest exists: ${manifest_path}" "${output}" "${manifest_path}:exists=True"
     assert_contains "dev runtime manifest owned: ${manifest_path}" "${output}" "${manifest_path}:owned=True"
-    assert_contains "dev runtime manifest has proof policy: ${manifest_path}" "${output}" "${manifest_path}:policy=True"
+    assert_contains "dev runtime manifest has proof policy: ${manifest_path}" "${output}" "${manifest_path}:policy=${expected_policy}"
     assert_contains "dev runtime manifest is in contract: ${manifest_path}" "${output}" "${manifest_path}:contract=True"
   done