chore: commit remaining worktree changes

backend/scripts/verify-workspace-descriptor-files.mjs

@@ -15,9 +15,6 @@ const allowedKinds = new Set(["policy_text", "workspace_descriptor", "deployment
 // opener line through the closer line (including physical line endings). These
 // blocks are reviewed non-workspace runtime/config generation, not semantic proof.
 const reviewedExpandableBlocks = new Map([
-  ["scripts/preprocess-smoke.sh", [
-    { sha256: "fc530dc721c946644ab6552bbd46b7918d6c5f11f06f3495b6ea1fcda819b38d", rationale: "Generates the reviewed preprocess Compose override." },
-  ]],
   ["scripts/test-dwh-auth-nginx-integration.sh", [
     { sha256: "ead57234ad3520b5c7d4262b772957cbc7b9589da4f35fb17b160f948eb2ac7b", rationale: "Generates the reviewed isolated Nginx integration configuration." },
   ]],

backend/scripts/verify-workspace-descriptor-files.test.mjs

@@ -624,7 +624,6 @@ test("an in-band marker cannot authorize expandable content", async (t) => {
 
 test("current exact reviewed expandable blocks pass only at their trusted paths", async (t) => {
   const reviewedPaths = [
-    "scripts/preprocess-smoke.sh",
     "scripts/test-server-pi-state-topology.sh",
     "scripts/test-vector-backup-restore-safety.sh",
     "scripts/test-windows-clone-contract.ps1",
@@ -636,19 +635,6 @@ test("current exact reviewed expandable blocks pass only at their trusted paths"
     root: repositoryRoot,
     entries: reviewedPaths.map((path) => entry("deployment_script", path)),
   });
-
-  const root = await fixture(t);
-  const original = await readFile(join(repositoryRoot, "scripts/preprocess-smoke.sh"), "utf8");
-  await put(root, "scripts/copied-preprocess.sh", original);
-  await assert.rejects(
-    verifyEntries({ root, entries: [entry("deployment_script", "scripts/copied-preprocess.sh")] }),
-    /exact-content reviewed allowlist/,
-  );
-  await put(root, "scripts/preprocess-smoke.sh", original.replace('$tmp/smoke.yaml', '$tmp/other.yaml'));
-  await assert.rejects(
-    verifyEntries({ root, entries: [entry("deployment_script", "scripts/preprocess-smoke.sh")] }),
-    /exact-content reviewed allowlist/,
-  );
 });
 
 test("PowerShell tokenizer ignores opener text in comments and ordinary strings", async (t) => {