fix: cover every tracked release input

tests/unit/repository-file-inventory.test.ts

@@ -26,8 +26,11 @@ function gitResult(
 async function repositoryFixture() {
   const root = await mkdtemp(path.join(tmpdir(), "repository-inventory-"));
   await mkdir(path.join(root, "src"));
+  await mkdir(path.join(root, "docs"));
   await writeFile(path.join(root, "src", "tracked.ts"), "tracked\n");
   await writeFile(path.join(root, "src", "untracked.ts"), "untracked\n");
+  await writeFile(path.join(root, "README.md"), "readme\n");
+  await writeFile(path.join(root, "docs", "outside-policy.md"), "docs\n");
   return root;
 }
 
@@ -90,6 +93,23 @@ describe("repository file inventory", () => {
     expect(inventory.files).not.toContain("src/untracked.ts");
   });
 
+  it("includes every Git-tracked file outside mandatory policy roots", async () => {
+    const repositoryRoot = await repositoryFixture();
+    const inventory = await buildRepositoryFileInventory({
+      repositoryRoot,
+      trackedRoots: ["src"],
+      runGit: () =>
+        gitResult("src/tracked.ts\0README.md\0docs/outside-policy.md\0"),
+    });
+
+    expect(inventory.trackedFiles).toEqual([
+      "README.md",
+      "docs/outside-policy.md",
+      "src/tracked.ts",
+    ]);
+    expect(inventory.files).toEqual(inventory.trackedFiles);
+  });
+
   it("rejects duplicate tracked paths instead of silently deduplicating", async () => {
     const repositoryRoot = await repositoryFixture();
     await expect(
@@ -214,6 +234,34 @@ describe("repository file inventory", () => {
     expect(inventory.files).toEqual(["dist/asset.js", "src/tracked.ts"]);
   });
 
+  it("rejects an exact tracked and generated path collision", async () => {
+    const repositoryRoot = await repositoryFixture();
+    await writeFile(path.join(repositoryRoot, "package.json"), "{}\n");
+
+    await expect(
+      buildRepositoryFileInventory({
+        repositoryRoot,
+        trackedRoots: ["package.json"],
+        generatedRoots: ["package.json"],
+        runGit: () => gitResult("package.json\0"),
+      }),
+    ).rejects.toThrow(/tracked.*generated.*package\.json/u);
+  });
+
+  it("accepts a legal child whose name begins with two dots", async () => {
+    const repositoryRoot = await repositoryFixture();
+    await mkdir(path.join(repositoryRoot, "..assets"));
+    await writeFile(path.join(repositoryRoot, "..assets", "legal.ts"), "legal\n");
+
+    await expect(
+      buildRepositoryFileInventory({
+        repositoryRoot,
+        trackedRoots: ["..assets"],
+        runGit: () => gitResult("..assets/legal.ts\0"),
+      }),
+    ).resolves.toMatchObject({ trackedFiles: ["..assets/legal.ts"] });
+  });
+
   it("fails closed when an inventoried file cannot be read", async () => {
     const repositoryRoot = await repositoryFixture();
     await expect(