fix(agent-rules): accept both scope-index headings in validation

[CybotTM]

Problem

generate-agents.sh emits the root scope index under the heading

## Scoped AGENTS.md (MUST read when working in these directories)

(strengthened from the legacy ## Index of scoped AGENTS.md in commit bbb6899), but validate-structure.sh still grepped for the legacy literal in three places. A freshly generated root longer than 50 lines therefore failed the skill's own structure validation:

❌ ERROR: Root is bloated: 111 lines and no scope index

Fixes #55.

Fix

Introduce one shared ERE — ^## (Index of scoped|Scoped) AGENTS\.md — and use it in all three checks (check_root_is_thin, the check_scope_links guard, and the sed block extraction). This keeps the validator in sync with the generator and backward-compatible with files produced by older versions and the reference examples, which still use the legacy heading (including this repo's own root AGENTS.md).

Regression guard

skills/agent-rules/scripts/tests/test-scope-index-heading.sh drives generate-agents.sh → validate-structure.sh end to end and asserts:

1. a generated root (new heading, >50 lines) validates — the validate-structure.sh rejects the scope-index heading that generate-agents.sh emits #55 regression;
2. a root rewritten to the legacy heading still validates — backward compatibility;
3. a bloated root with no scope index is still rejected — no over-relaxation.

A new Test Scripts workflow (.github/workflows/test-scripts.yml) runs it on PRs touching skills/agent-rules/scripts/** or assets/**.

Verification

✅ PASS: generated root (111 lines, new heading) validates
✅ PASS: root with legacy heading still validates (backward compatible)
✅ PASS: bloated root without a scope index is still rejected

The test was confirmed to fail against the pre-fix validator (exits 1 at test 1) and pass against the fix — so it is a genuine guard, not a tautology. actionlint, shellcheck, and bash -n all clean.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	11bd71901bbe5b1630ceea73d27597364c9af683	🟢 6.9	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 16 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• .github/workflows/test-scripts.yml

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[gemini-code-assist]

Code Review

This pull request introduces a regression test script (test-scope-index-heading.sh) and updates validate-structure.sh to support both current and legacy scope-index headings via a regular expression, ensuring backward compatibility. The review feedback highlights portability issues with using sed -i without arguments in the test script on macOS versus Linux, suggesting a temporary file redirection approach instead.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud