wip(rm-02): round-4 remediation held at RM-60 boundary

scripts/gate-wiring.test.mjs

@@ -13,12 +13,8 @@ const expectedTriggers = `when:
   - event: push
     branch: main`;
 const expectedGateStep = `    image: *node_image
-    # Woodpecker's shallow marker makes merge-base reject even present parents;
-    # full history is required for activation ancestry and manifest provenance.
     commands:
       - *enable_pnpm
-      - apk add --no-cache bubblewrap
-      - if [ -f .git/shallow ]; then git fetch --unshallow --no-tags origin; fi
       - pnpm gate:verify
     depends_on:
       - install
@@ -52,7 +48,11 @@ export function assertUnprivilegedGateStep(pipeline) {
   // Closed textual construction by design: accepting arbitrary YAML syntax here
   // would require a duplicate-key-preserving parser. Exact equality rejects all
   // extra keys, quoted/escaped key spellings, aliases, and mapping merges.
-  assert.equal(matches[0][1].trimEnd(), expectedGateStep, 'gate-verify step must match closed unprivileged construction');
+  assert.equal(
+    matches[0][1].trimEnd(),
+    expectedGateStep,
+    'gate-verify step must match closed unprivileged construction',
+  );
 }
 
 test('package.json exposes the canonical gate:verify command', async () => {
@@ -77,7 +77,10 @@ test('gate wiring rejects privilege syntax, merges, duplicate keys, and trigger
     '    "<<": *privileged-step\n',
   ];
   for (const addition of additions) {
-    const changed = pipeline.replace('  gate-verify:\n    image:', `  gate-verify:\n${addition}    image:`);
+    const changed = pipeline.replace(
+      '  gate-verify:\n    image:',
+      `  gate-verify:\n${addition}    image:`,
+    );
     assert.throws(() => assertUnprivilegedGateStep(changed));
   }
   const privilegedInstall = pipeline.replace(
@@ -85,10 +88,7 @@ test('gate wiring rejects privilege syntax, merges, duplicate keys, and trigger
     '  install:\n    privileged: true\n    image:',
   );
   const duplicate = `${pipeline}\n  gate-verify:\n    image: *node_image\n`;
-  const noPullRequest = pipeline.replace(
-    '  - event: [pull_request, manual]',
-    '  - event: manual',
-  );
+  const noPullRequest = pipeline.replace('  - event: [pull_request, manual]', '  - event: manual');
   const filteredPullRequest = pipeline.replace(
     '  - event: [pull_request, manual]',
     '  - event: [pull_request, manual]\n    path: [scripts/**]',