Phase 2: Tier-1 Gaps 4+5 — upstream-cut invariants + .pot parity

[lucas-albers-lz4]

Phase 2: Tier-1 Gaps 4+5 — upstream-cut invariants + .pot parity

Part of the wave tracked in #271. Source of truth: #240 §3 Tier 1 (Gaps 4, 5) and the round-2 synthesis.

Objective

Give the re-cut pipeline and the translation template the same seconds-grade pinning the shell boundary already has, with measured wall time.

Scope

• Gap 4: run upstream-cut.sh to a temp dir and assert the luci-shaped invariants: Makefile include rewritten to ../../luci.mk, no SOURCE_DATE_EPOCH block, no docker-sdk references, README link rewritten to the blob URL, po/templates present, locale dirs dropped, .pot reference paths applications/-prefixed.
• Gap 5: run i18n-scan.pl on a cut tree and assert msgids match the checked-in .pot exactly (paths normalized).
• Measure wall time on ubuntu-latest before merge. The OpenWrt-tree scanner availability is unbudgeted — confirm it runs in CI or scope the test to what CI provides.

Non-goals

• No Gap 2/3 work (Phase 1). No cut-script redesign — pin current output shape only.

Acceptance criteria

• Temp-dir cut asserts all seven luci-shaped invariants. Failure names the invariant.
• .pot msgid parity passes with paths normalized. A changed UI string without .pot update fails the test.
• Measured wall time recorded in the PR. Per-PR gate stays seconds-grade.
• fwlive-test.sh green. Shellcheck green.
• Rebased on docs(security): multi-model VVAH audit playbook + honest-gap scripts #268 after it merges (keep both test entries on conflict).

Depends-on

None. Parallel-safe with Phases 1 and 3.

Effort

M. Gated on openwrt/luci#8992 landing (parked until upstream lands, per plan).

[lucas-albers-lz4]

Phase 2 implemented in PR #278 (branch fix/273-phase2-cut-pot, tests only: new tests/fwlive-upstream-cut.test.sh + fwlive-test.sh wiring).

One deviation from the issue text: it says .pot paths applications/-prefixed, but the cut keeps the checked-in .pot byte-identical (openwrt-feed/ paths); the applications/-shaped .pot is regenerated in the luci tree by i18n-scan.pl. Pinned current shape per the no-redesign non-goal.

Gap 5 proven 132/132 msgids locally via FWLIVE_I18N_SCAN; skips gracefully in CI where no luci tree exists. Cut wall time about 4 s. Red-proved twice. Merge pending your approval, which closes this issue.

[lucas-albers-lz4]

Luna gate NO_GO folded: msgid parser is now multiline-aware (msgid "" + continuations joined). Old single-line regex silently dropped 17 msgids (132 vs true 149); fresh scan now parses 149/149. Pushed to PR #278.