fix: stop test fixtures from deleting the repository's dependencies

Four fixtures linked the installed dependencies into a throwaway root with a
single directory symlink at <fixture>/node_modules, then ran pnpm inside that
root. pnpm does not recognise the modules directory it finds there and purges
it; with CI=true it does so without a prompt. The purge followed the symlink and
deleted the repository's own node_modules mid-run, so a test suite uninstalled
the workspace it was running in. That is what produced the cascading,
file-unrelated failures a full test:unit run reported, and it happened twice
while running the suites for the adapter re-review.

scripts/lib/fixture-node-modules.ts replaces all four sites: node_modules is a
real directory whose entries are individual symlinks, so a recursive delete
unlinks the fixture's own links instead of walking through one link into the
shared tree. Resolution is unchanged.

tests/unit/fixture-node-modules.test.ts performs the exact recursive delete pnpm
performs and asserts the source tree survives, and check:adapter-inventory now
fails on any reintroduction of the directory-symlink form — verified by putting
the old line back and watching the gate reject it.

A full tests/unit + tests/integration run now leaves the dependencies intact.
removal-fixture, supply-chain and security-followup-archive, the three suites
that had to be excluded before, pass in that run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/check-adapter-inventory.ts

@@ -91,6 +91,38 @@ async function main(): Promise<void> {
     }
   }
 
+  // A fixture that links the repository's node_modules with a single directory
+  // symlink is destructive: pnpm running inside that fixture purges the modules
+  // directory it does not recognise, follows the link, and deletes the real
+  // dependencies mid-run. `linkFixtureNodeModules` is the only sanctioned form.
+  const sources = spawnSync(
+    "git",
+    ["grep", "-n", "-e", 'symlink(', "--", "scripts", "tests"],
+    { encoding: "utf8" },
+  );
+  if (sources.status === 0) {
+    for (const line of sources.stdout.split("\n").filter(Boolean)) {
+      if (!line.includes("node_modules")) continue;
+      if (line.startsWith("scripts/lib/fixture-node-modules.ts:")) continue;
+      problems.push(
+        `fixture node_modules: use linkFixtureNodeModules instead — ${line}`,
+      );
+    }
+  }
+  const linkedFixtures = spawnSync(
+    "git",
+    ["grep", "-l", "linkFixtureNodeModules", "--", "scripts", "tests"],
+    { encoding: "utf8" },
+  );
+  if (
+    linkedFixtures.status !== 0 ||
+    linkedFixtures.stdout.split("\n").filter(Boolean).length < 2
+  ) {
+    problems.push(
+      "fixture node_modules: the shared linker has no callers, so it is not the sanctioned path",
+    );
+  }
+
   if (problems.length > 0) {
     for (const problem of problems) console.error(problem);
     process.exitCode = 1;
@@ -100,7 +132,8 @@ async function main(): Promise<void> {
     `Adapter inventory: ${tracked.length} files PASS; ` +
       `service worker asset table: ${
         Object.keys(CACHEABLE_ASSET_CONTENT_TYPES).length
-      } shared extensions PASS`,
+      } shared extensions PASS; ` +
+      `fixture node_modules linking PASS`,
   );
 }