check-lint-pins.sh: remaining scan gaps after #37

[charlesgreen]

Follow-up to #37. That issue's gaps are closed (see the PR). Fixing them, plus review of the fix itself, surfaced a further list of gaps that are real but out of scope for a merge-blocking fix. Recorded here per this repo's own gate-philosophy: a gap that should eventually close needs a tracked issue, not a silent skip.

None of these is believed to be currently exploited or exercised anywhere in this repo's actual content — they are documented blind spots in the pattern/scan, not known-bad states.

• pnpm dlx, yarn dlx, bunx, npm exec are npx-equivalent registry-fetch spellings; only literal npx is matched.
• npm_config_global=true npm install pkg (the env-var form of --global) is not matched.
• A line with a # in it that isn't a comment — e.g. a git URL fragment like npm install https://github.com/a/b#v1 -g — has everything after the first # stripped before matching (this is a deliberate trade made in the check-lint-pins.sh misses several spellings of an unpinned install #37 fix: stripping comments outright closes a class of false-clears where a comment mentioning -g/--global in prose could get glued onto real code and misread, at the cost of also missing a real flag that happens to follow a # earlier on the same line).
• scan_manifest_scripts (package.json's own scripts/lifecycle-hook block) does not run the same backslash-continuation join the file scanners do, so a continuation split across an embedded value would be missed. Asymmetric with the rest of the scan.
• -g attached directly to its value with no space (npm i -gmarkdownlint-cli2) is not matched by the new whitespace-bounded pattern. (Unclear this is valid npm syntax at all — -g takes no value — so this may not be a real evasion.)
• A broken/dangling tracked symlink under a scanned path produces an awk read error that the scan's || true swallows rather than surfacing.
• find "$path" -type f does not follow symlinks, so a symlinked file under a scanned directory is never opened (a symlink tracked directly by git, as opposed to one found via find, is fine — git ls-files lists it and awk follows it on open).

Not urgent for the same reason #37 wasn't: npm ci already fails hard when package.json and the lockfile disagree, so the pinning holds for every path CI actually takes today. These are precision gaps in the audit trail, not live holes.

[charlesgreen]

Resolved in #40. Verdict per item:

• pnpm dlx / yarn dlx / bunx / npm exec — fixed. exec is scoped to npm only (not the shared npm/pnpm/yarn/bun group -g uses), since yarn exec/pnpm exec are common commands that just run an already-local binary and fetch nothing — matching them broadly would have been a real false positive, not the same trade -g makes.
• npm_config_global=true (env-var form) — fixed, both casings.
• scan_manifest_scripts not joining continuations — fixed. join_continuations now takes stdin instead of a file argument so it can also sit in front of jq's output.
• Broken symlink swallowed by || true — fixed, now a hard fail with a clear message.
• -g attached with no space (-gpkg) — closed, not applicable. Confirmed -g is a boolean npm flag with no attached-value syntax, so there's no real evasion here.
• # in a non-comment position (e.g. a git-URL fragment) — staying as-is, deliberate. This is the documented trade from Close check-lint-pins.sh scan gaps from #37 #39: stripping everything after a # before matching is what fixed the comment-swallowing false-clears, and re-examining post-# content would reopen those. Narrower, more contrived gap than what was traded away.
• find -type f not following symlinks under SCANNED — not fixed, considered out of scope. Anything merged into the repo is tracked, so git ls-files (the stray-script scan) already sees it regardless of find's behavior here. Adding -L would reopen a read-outside-the-repo path that the Close check-lint-pins.sh scan gaps from #37 #39 review only accepted for git-tracked symlinks specifically.

Closing.

[charlesgreen]

Closed via #40

[charlesgreen]

Reopening — leaving this open until PR #40 actually merges, consistent with how #37 was closed by #39's merge rather than by hand.