fix(runner): reject dev-only exceptions under wildcard exports

Treat unexpanded wildcard export targets as potentially exposing every scanned source, so they cannot bypass the reviewed private eval harness boundary.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/paperclip-runner/scripts/check-forbidden-imports.test.mjs

@@ -190,3 +190,14 @@ test("direct or transitive public harness exposure revokes the dev-only exceptio
     }
   }
 });
+
+
+test("unexpanded wildcard exports cannot expose the reviewed development harness", async (t) => {
+  const violations = await fixtureBoundary(t, {
+    manifest: { ...reviewedManifest, exports: { "./eval/*": "./dist/eval/*.js" } },
+    files: { [harness]: `import "${kernel}";` },
+  });
+  assert.equal(violations.length, 1);
+  assert.equal(violations[0].specifier, kernel);
+  assert.match(violations[0].reason, /outside the standalone boundary/);
+});

packages/paperclip-runner/scripts/lib/forbidden-imports.mjs

@@ -117,7 +117,12 @@ function publicSourceGraph(packageRoot, manifest, specifiers) {
       .map((suffix) => `${stem}${suffix}`)].filter((candidate) => known.has(candidate));
   };
   const targets = (value) => typeof value === "string" ? [value] : value && typeof value === "object" ? Object.values(value).flatMap(targets) : [];
-  const exportSources = (value) => targets(value).flatMap((target) => sourceCandidates(resolve(packageRoot, target)));
+  const exportSources = (value) => targets(value).flatMap((target) => {
+    // Wildcard exports can expose the development harness. Until this gate
+    // resolves their full mapping, conservatively treat all sources as public.
+    if (target.includes("*")) return [...known];
+    return sourceCandidates(resolve(packageRoot, target));
+  });
   const queue = exportSources(manifest.exports);
   const reachable = new Set();
   while (queue.length > 0) {