fix: enforce accounting coverage and recovery regression gates

Co-Authored-By: Paperclip <noreply@paperclip.ing>

scripts/__tests__/release-verify-workflow.test.mjs

@@ -456,3 +456,40 @@ test("direct protocol concurrency override only lowers the configured ceiling",
     if (expected !== null) assert.equal(result.stdout, expected);
   }
 });
+
+for (const workflow of ["release.yml", "e2e.yml", "storybook-visual.yml", "runner-live-evals.yml"]) {
+  test(`${workflow} keeps its frozen dependency install and fails closed on stale locks`, () => {
+    const text = readWorkflow(workflow);
+    const job = workflow === "release.yml" ? text.split("  smoke_canary_onboarding:\n")[1].split("\n  # ----- Nightly lane")[0] : text;
+    const install = job.match(/(?:- name: Install (?:test )?dependencies\n\s+run: ([^\n]+)|- run: (pnpm install[^\n]*))/);
+    assert.ok(install, "source workflow must expose a dependency install step");
+    const script = install[1] ?? install[2];
+    for (const exitCode of [0, 17]) {
+      const run = spawnSync("bash", ["-euo", "pipefail", "-c", `
+        pnpm() { printf '%s\n' "$*"; return "$INSTALL_EXIT"; }
+        ${script}
+      `], { encoding: "utf8", env: { ...process.env, INSTALL_EXIT: String(exitCode) } });
+      assert.equal(run.status, exitCode, run.stderr);
+      assert.equal(run.stdout.trim(), "install --frozen-lockfile", "never resolve new packages or retry after a frozen install failure");
+    }
+  });
+}
+
+test("the accounting CI lane installs only the reviewed lockfile and gates coverage on that install", () => {
+  const job = readWorkflow("pr-trusted.yml").split("  general_tests:\n")[1].split("  docker_context_integrity:\n")[0];
+  const install = job.split("      - name: Install dependencies\n")[1].split("      - name: Run grouped general test suites\n")[0];
+  const script = install.split("        run: |\n")[1];
+  assert.ok(script, "accounting lane must have an inspectable install command");
+  for (const exitCode of [0, 17]) {
+    const result = spawnSync("bash", ["-euo", "pipefail", "-c", `
+      pnpm() { printf '%s\\n' "$*"; return "$INSTALL_EXIT"; }
+      ${script}
+    `], { encoding: "utf8", env: { ...process.env, ACCOUNTING_GATE: "true", INSTALL_EXIT: String(exitCode) } });
+    assert.equal(result.status, exitCode, result.stderr);
+    assert.equal(result.stdout.trim(), "install --frozen-lockfile", "a stale lock must not resolve executable coverage code inline");
+  }
+  assert.match(install, /id: install_dependencies/);
+  assert.match(install, /ACCOUNTING_GATE: \$\{\{ matrix\.group == 'general-server-without-chat' && matrix\.shard_index == 0 \}\}/);
+  const coverage = job.split("      - name: Verify accounting coverage and crash recovery\n")[1].split("      - name: Upload accounting coverage\n")[0];
+  assert.match(coverage, /steps\.install_dependencies\.outcome == 'success'/, "failed installs must never load the coverage provider");
+});