feat(e2e): fail the gate if an example tracks a regenerable artifact (#134)

* feat(e2e): fail the gate if an example tracks a regenerable artifact

The examples-e2e harness runs each example in an isolated temp copy, so a
post-run git status on the repo tree never catches accidentally-committed
regenerable artifacts. Add a STATIC per-example guard, alongside
validateManifest / assertCommittedPin in loadExample, that inspects what git
TRACKS for the example (git ls-files -z, cwd: ROOT) and FAILS the example if
any tracked path is a regenerable artifact: .ponder/ or generated/ at any
depth, ponder-env.d.ts, or package-lock.json — exactly the paths the root
.gitignore already ignores. These must never be committed.

The guard requires no live run, RPC, or secrets, is dep-free, throws
HarnessFailure like the other static checks (so it participates in the same
PASS/FAIL table), and names the offending path(s) with a git rm --cached
remediation hint.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(e2e): anchor regenerable-artifact match to the example's direct children

isRegenerableArtifact matched `.ponder`/`generated` path segments at any depth,
which is broader than the .gitignore set it mirrors (examples/*/.ponder/,
examples/*/generated/, examples/*/ponder-env.d.ts, examples/*/package-lock.json
— all direct children). That would falsely fail a legitimately committed
nested `src/generated/` (e.g. graphql-codegen output).

Anchor the match: for a tracked path examples/<ex>/<rel>, FAIL iff the first
segment of <rel> is `.ponder` or `generated`, or <rel> is exactly
`ponder-env.d.ts` or `package-lock.json` — nothing deeper. The FAIL message,
`git rm --cached` hint, -z NUL parse, and HarnessFailure are unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: dzhelezov

scripts/examples-e2e.mjs

@@ -161,6 +161,7 @@ async function loadExample(example) {
 
   validateManifest(example, manifest);
   assertCommittedPin(example, manifest, pkg);
+  await assertNoTrackedArtifacts(example);
 
   return { dir, manifest, pkg };
 }
@@ -242,6 +243,51 @@ function ponderDependency(pkg) {
   return undefined;
 }
 
+async function assertNoTrackedArtifacts(example) {
+  const result = await runCommand(
+    'git',
+    ['ls-files', '-z', `examples/${example}`],
+    {
+      cwd: ROOT,
+      env: process.env,
+      timeoutMs: 30_000,
+    },
+  );
+  if (result.code !== 0) {
+    throw new HarnessFailure(
+      `${example}: git ls-files failed: ${result.stderr.tail(MAX_TAIL_LINES, redactUrls)}`,
+    );
+  }
+
+  const prefix = `examples/${example}/`;
+  const tracked = result.stdout
+    .text()
+    .split('\0')
+    .filter((path) => path.length > 0);
+  const offending = tracked.filter((path) =>
+    isRegenerableArtifact(path.slice(prefix.length)),
+  );
+  if (offending.length > 0) {
+    throw new HarnessFailure(
+      `${example}: git tracks regenerable artifact(s) that must never be committed: ${offending.join(', ')}; run \`git rm --cached ${offending.join(' ')}\` (they are gitignored regenerables)`,
+    );
+  }
+}
+
+function isRegenerableArtifact(relative) {
+  const segments = relative.split('/');
+  const first = segments[0];
+  if (first === '.ponder') return true;
+
+  if (first === 'generated') return true;
+
+  if (relative === 'ponder-env.d.ts') return true;
+
+  if (relative === 'package-lock.json') return true;
+
+  return false;
+}
+
 function checkLatestPin(example, manifest, pkg, latest) {
   const dependency = ponderDependency(pkg);
   if (dependency !== latest) {