fix(devx): read escaping IMPORT specifiers in the cross-package input gate, and gate the hand-written .d.mts mirrors

.github/workflows/lint.yml

@@ -1329,10 +1329,42 @@ jobs:
  - name: Shard partitioner self-test
  run: node scripts/partition-test-shards.mjs --self-test
 
+ # Hand-written `.d.mts` mirrors (#10549). `scripts/js-comment-mask.mjs`
+ # and `scripts/check-regen-pending.mjs` are untyped `.mjs` that each ship
+ # a hand-written declaration beside them, and both files say "keep this in
+ # step with the module by hand". Nothing checked that they were. A
+ # `.d.mts` has no runtime existence, so nothing executes it and nothing
+ # notices: TypeScript consumers see ONLY the declaration, so a drift makes
+ # every consumer type-check GREEN against a signature the module does not
+ # implement, first symptom a runtime failure downstream. That this file
+ # silently decides typecheck outcomes is measured rather than theoretical
+ # — PR #10513 went red with `TS2578` on two lanes purely because the
+ # mirror existed on the merged tree and not on the branch's, and that
+ # episode cost PR #10450 two merge-queue evictions. This gate asserts
+ # name, kind and required arity per declared export, and it DISCOVERS its
+ # corpus (every `scripts/**/*.d.mts`), so a third mirror added tomorrow is
+ # covered by existing rather than by anyone remembering to enrol it.
+ # Invoked as `node` rather than through a `pnpm check:*` alias for the
+ # same reason as the two steps above: that alias belongs in root
+ # package.json, declared territory of the @changesets/cli v3 lane (#9465)
+ # while it runs. dispatch-gates.mjs derives gate families from either
+ # spelling. Imports two small modules; milliseconds.
+ - name: Hand-written declaration mirrors
+ run: |
+ node scripts/check-declaration-mirrors.mjs --self-test
+ node scripts/check-declaration-mirrors.mjs
+
  # The inventory of `packages/**` tests coupled to `examples/**` (#8754).
- # Sibling of the gate above, on the axis it cannot see: that one detects
- # tests whose FILESYSTEM READS escape their package, this one detects
- # tests that IMPORT an example app live. `packages/cli` dynamically
+ # Sibling of the cross-package gate above, on the axis that gate does not
+ # own. ⚠️ The line that used to stand here — "that one detects tests whose
+ # FILESYSTEM READS escape their package, this one detects tests that
+ # IMPORT an example app live" — stopped being true in #10452, which taught
+ # the cross-package gate to read escaping import SPECIFIERS as well as
+ # path-shaped reads. Both now see the same couplings and do different
+ # things with them: the cross-package gate turns one into a declared input
+ # radius plus the turbo glob that hashes it, while this gate keeps the
+ # `examples/**` INVENTORY and grades what CI can see of each entry.
+ # `packages/cli` dynamically
  # imports `examples/app-showcase/src/ui/views/contact.view` and asserts
  # `toEqual` over a hardcoded `_sections` key list; `packages/lint`
  # statically imports the same app's `Contact`/`ContactViews`. Neither