fix: fail closed on release input discovery

tests/unit/supply-chain.test.ts

@@ -1,3 +1,5 @@
+import { readFile } from "node:fs/promises";
+
 import { describe, expect, it } from "vitest";
 
 import {
@@ -22,6 +24,53 @@ const dependency = {
 };
 
 describe("supply-chain policy", () => {
+  it("uses one fail-closed repository inventory for provenance and secret scanning", async () => {
+    const [provenanceSource, securitySource] = await Promise.all([
+      readFile("scripts/generate-supply-chain.ts", "utf8"),
+      readFile("scripts/security-scan.ts", "utf8"),
+    ]);
+    for (const source of [provenanceSource, securitySource]) {
+      expect(source).toContain("buildRepositoryFileInventory");
+      expect(source).not.toContain("async function filesWithin");
+    }
+  });
+
+  it("covers every mandatory release input in the secret scan policy", async () => {
+    const policy = JSON.parse(
+      await readFile("config/security/secret-scan-policy.json", "utf8"),
+    ) as { trackedRoots: string[] };
+    expect(policy.trackedRoots).toEqual(
+      expect.arrayContaining([
+        "index.html",
+        ".dependency-cruiser.json",
+        ".nvmrc",
+        ".npmrc",
+        "eslint.config.ts",
+        "package.json",
+        "pnpm-lock.yaml",
+        "pnpm-workspace.yaml",
+        "scripts",
+        "schemas",
+        "config",
+        ".gitea/workflows/quality-gates.yml",
+        "vite.config.ts",
+        "vite.service-worker.config.ts",
+        "playwright.capabilities.config.ts",
+        "playwright.dev.config.ts",
+        "playwright.storybook.config.ts",
+        "playwright.visual.config.ts",
+        "tsconfig.json",
+        "tsconfig.app.json",
+        "tsconfig.base.json",
+        "tsconfig.node.json",
+        "tsconfig.recipes.json",
+        "tsconfig.service-worker.json",
+        "tsconfig.test.json",
+        "tsconfig.web-worker.json",
+      ]),
+    );
+  });
+
   it("parses every top-level lockfile package and validates SRI", () => {
     const parsed = parsePnpmLockfilePackages(`
 packages: