fix(coverage): restore validated npm workspace lock owners

[seonghobae]

What

Restore the fail-closed npm workspace lock-owner resolver and its central OpenCode coverage integration in a clean replacement for closed #703.

A selected nested package such as apps/desktop can install from its nearest validated workspace owner instead of requiring an invalid duplicate lockfile beside every workspace package.

Root cause

BandScope owns one root npm workspace lock for apps/* and packages/*. The central coverage path selected apps/desktop, attempted an isolated installation inside that directory, failed to materialize Vitest, and converted infrastructure incompleteness into REQUEST_CHANGES on otherwise valid product PRs.

Trust boundary

• resolve ownership from exact validated Git revisions and the matching bounded worktree;
• require npm lockfile version 2 or 3 with an exact packages entry for the selected workspace;
• preserve npm-shrinkwrap.json precedence over package-lock.json;
• anchor workspace patterns at the repository root and implement a fail-closed minimatch subset;
• mirror npm's unconditional **/node_modules/** workspace exclusion;
• reject traversal, negation, brace/extglob syntax, control characters, malformed Git metadata, path escape, and symlinks;
• verify base-or-head dependency materialization receipts before installation;
• execute structured npm ci --workspace <selector> argv from the validated owner;
• retain --offline --ignore-scripts --no-audit --no-fund and bounded cache semantics;
• preserve standalone package selection and nested modular repositories;
• leave no PR-number-specific, self-modifying, or branch-push workflow in the final tree.

Verification contract

• focused resolver and adversarial hardening tests;
• a real temporary apps/desktop workspace fixture resolves to repository root;
• a tracked apps/node_modules fixture remains excluded even under apps/*, matching npm's authoritative workspace discovery;
• resolver statement and branch coverage: 100%;
• production docstrings: 100%;
• Python compile, Ruff, workflow contract, full central tests, and git diff --check;
• exact-current-head security, CodeQL, Semgrep, dependency, secret, SBOM, Scorecard, OpenCode, Noema, and branch-protection gates.

Standards and doctoring

docs/doctoring/npm-workspace-lock-ownership.md records the central/product MSA boundary, trust model, fail-closed limitations, verification contract, and APA 7th references to the current npm CLI 12.0.2 documentation and the authoritative @npmcli/map-workspaces implementation.

Stacking and cleanup

This PR is intentionally draft until central baseline #731 merges. The branch currently retains the overlapping CodeQL/Strix baseline inherited from the former implementation history; after #731 lands, those overlapping files must be reconciled against the new protected main so the final diff contains only:

• .github/workflows/opencode-review-dispatch.yml
• docs/doctoring/npm-workspace-lock-ownership.md
• scripts/ci/npm_workspace_install_root.py
• tests/npm_workspace_test_support.py
• tests/test_npm_workspace_install_root.py
• tests/test_npm_workspace_install_root_hardening.py
• tests/test_opencode_agent_contract.py

The superseded PR-specific repair workflow has already been removed. No completion or green-check claim is made before the cleaned exact head is verified.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 131398c0-2891-4957-8370-cf331b57fad4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}