fix: let a removal fixture actually build the thing it claims still builds

FE-GATE-020 proves a capability can be removed by rebuilding the whole project
without it. The fixture it built could not get that far, and the failures all
came from the fixture rather than from anything about removability.

It was not a repository. The supply-chain inventory is defined as the tracked
file set, so it asks `git ls-files` what the project contains; with no
repository to ask, generation failed and took every provider suite down with
it. It is now initialised on preparation and committed after the removal — not
before, or the index would still list the files the removal deleted.

It had no `.gitignore`, so once it did have a repository, every generated
artifact and every linked module landed in the index and the inventory refused
the fixture for tracked and generated paths colliding. It carries the ignore
rules now, and therefore records the same tracked set as the repository it was
copied from.

Each removal script kept its own copy-target list and they had drifted: the
reference-feature fixture omitted `playwright.capabilities.config.ts`, which the
inventory requires. There is one list now. It also gained the install and
workspace identity — `.npmrc`, the lockfile, the workspace file — without which
the fixture is a different project, and the release evidence a candidate is
assembled from, without which no candidate can be built at all.

A tracked root the removal deletes is no longer required of the result: the
optional-recipe fixture deletes `recipes/`, and the inventory policy demanded
it back. Roots that are gone are pruned from the fixture's policy.

Two smaller causes. A platform integration file asserted the reference feature's
own route ids, so removing the feature left it importing a deleted module —
typecheck, the test run, coverage and the residue scan all failed on that one
misplaced assertion, which now lives in the feature's test tree. And the
canonical exact-count authority was re-imposed on a contract the fixture
deliberately reduces, failing the fixture for the reduction it exists to prove;
`CI_CONTRACT_MODE` already marked those runs and is now honoured by default.

The reference-feature fixture goes from failing before its first assertion to
1,612 passing with one failure, and that one is the live process-tree
observation test already red on the main tree.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/ci-artifact-contract.test.ts

@@ -20,6 +20,7 @@ import {
 } from "../../scripts/lib/ci-artifact-validator.ts";
 import { writeCiGateLogAtomic } from "../../scripts/lib/ci-gate-log.ts";
 import { linkFixtureNodeModules } from "../../scripts/lib/fixture-node-modules.ts";
+import { copyReleaseEvidenceTree } from "../../scripts/lib/removal-fixture.ts";
 import { captureCiCandidateArchive, verifyCiCandidateArchive } from "../../scripts/lib/ci-candidate-archive.ts";
 import {
   CANDIDATE_ARCHIVE_USAGE,
@@ -2153,10 +2154,17 @@ async function ensureProviderBaseFixture(): Promise<string> {
       return ![".release", "artifacts", "dist", "node_modules"].includes(first ?? "");
     },
   });
-  await cp(path.join(sourceRoot, "artifacts"), path.join(root, "artifacts"), {
-    recursive: true,
-  });
-  await rm(path.join(root, "artifacts/release"), { recursive: true, force: true });
+  // The release evidence, minus the trace and Storybook trees. Copying the
+  // whole `artifacts/` directory pulled ~28MB of test output into every
+  // provider fixture; sharing the copier with the removal fixture is also what
+  // makes both fixtures contain the same evidence.
+  // `artifacts/release` travels with the fixture rather than being deleted and
+  // rebuilt. Supply-chain generation runs before the candidate is created and
+  // validates the release evidence paths, so deleting them made that step
+  // depend on a previous local run having left them behind — which is why this
+  // fixture only worked in a workspace that had already built a candidate. The
+  // build chain overwrites them anyway.
+  await copyReleaseEvidenceTree(sourceRoot, root);
   await linkFixtureNodeModules(root, sourceRoot);
   const git = spawnSync("git", ["show", "-s", "--format=%H%n%ct", "HEAD"], {
     cwd: sourceRoot,

tests/unit/removal-fixture.test.ts

@@ -2,7 +2,7 @@ import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 
-import { afterEach, expect, it } from "vitest";
+import { afterEach, describe, expect, it } from "vitest";
 
 import { loadCiGateContract } from "../../scripts/contracts/ci-gates.ts";
 import {
@@ -88,3 +88,34 @@ it("rejects pruning that leaves a reduced gate without commands", async () => {
     removedEvidencePathFragments: ["runtime-schema.xml"],
   })).rejects.toThrow(/commandIds|too small|at least 1/i);
 });
+
+describe("release evidence fixture copy", () => {
+  it("keeps the release evidence and leaves the regenerated trees behind", async () => {
+    const { copyReleaseEvidenceTree, RELEASE_EVIDENCE_REGENERATED_TREES } =
+      await import("../../scripts/lib/removal-fixture.ts");
+    const { RELEASE_CANDIDATE_EVIDENCE_PATHS } = await import(
+      "../../scripts/lib/release-candidate.ts"
+    );
+    const { mkdtemp, access, readdir } = await import("node:fs/promises");
+    const { tmpdir } = await import("node:os");
+    const nodePath = (await import("node:path")).default;
+
+    const root = await mkdtemp(nodePath.join(tmpdir(), "release-evidence-"));
+    await copyReleaseEvidenceTree(process.cwd(), root);
+
+    // Every artifact a candidate archive is assembled from has to survive; a
+    // fixture missing one of these cannot build a candidate at all, and every
+    // provider suite then fails while constructing its own fixture.
+    for (const evidence of RELEASE_CANDIDATE_EVIDENCE_PATHS) {
+      if (!evidence.startsWith("artifacts/")) continue;
+      await expect(access(nodePath.join(root, evidence)), evidence).resolves.toBeUndefined();
+    }
+    // The regenerated trees are why this is a filter and not a plain copy: they
+    // are tens of megabytes of traces and coverage HTML. They still exist,
+    // because the repository inventory expects the directories.
+    for (const tree of RELEASE_EVIDENCE_REGENERATED_TREES) {
+      await expect(access(nodePath.join(root, tree)), tree).resolves.toBeUndefined();
+      await expect(readdir(nodePath.join(root, tree)), tree).resolves.toEqual([]);
+    }
+  });
+});

tests/unit/task3-selective-integration.test.ts

@@ -6,6 +6,7 @@ import path from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
 
 import {
+  isReducedCiContractRun,
   loadCiGateContract,
   parseCiGateContract,
 } from "../../scripts/contracts/ci-gates.ts";
@@ -175,7 +176,10 @@ describe("selective Task 3 contract closure", () => {
       .toContain("package script missing: root -> missing");
   });
 
-  it("accepts only the canonical exact-count authority and rejects orphan retention", async () => {
+  // A removal fixture runs against a pruned contract on purpose, so the
+  // canonical counts do not describe it. Asserting them there failed the
+  // fixture for the reduction it exists to demonstrate.
+  it.skipIf(isReducedCiContractRun())("accepts only the canonical exact-count authority and rejects orphan retention", async () => {
     const canonical = await loadCiGateContract(process.cwd());
     expect(canonical.gates).toHaveLength(27);
     expect(canonical.commands).toHaveLength(82);
@@ -189,7 +193,7 @@ describe("selective Task 3 contract closure", () => {
     expect(() => parseCiGateContract(orphan)).toThrow(/five canonical retention|orphan retention/u);
   });
 
-  it("rejects the retired validate-candidate-archive grammar", async () => {
+  it.skipIf(isReducedCiContractRun())("rejects the retired validate-candidate-archive grammar", async () => {
     const canonical = JSON.parse(
       JSON.stringify(await loadCiGateContract(process.cwd())),
     ) as Record<string, any>;