fix(ci): stop the ci-failure self-test minting a failure annotation on every green lint run

.github/workflows/lint.yml

@@ -788,6 +788,49 @@ jobs:
  node scripts/check-self-test-wired.mjs --self-test
  node scripts/check-self-test-wired.mjs
 
+ # Self-test output vs. the runner's command parser (#11886). Sibling of
+ # the step above and sharing its population: that one asks whether CI RUNS
+ # each self-test, this one asks what each self-test PRINTS while it does.
+ #
+ # The defect it closes was live on every PR in this repo. A line of
+ # `scripts/pm/ci-failure.mjs`'s self-test prose named a workflow-command
+ # token literally, inside backticks, as documentation of what that tool
+ # anchors on. The runner does not know a token is being quoted: it parsed
+ # it and minted `annotation_level: failure` on a check run whose
+ # conclusion was SUCCESS. On `d63b01436` that artifact was the ONLY
+ # annotation the `Lint & Repo Gates` run carried. A failure-level
+ # annotation on a green required check is a claim that something failed,
+ # and a repo that mints one on every PR is teaching its readers to skim
+ # exactly the surface other gates report findings into.
+ #
+ # ⚠️ INVISIBLE TO EVERY LOCAL RUN, which is the whole reason it is a gate:
+ # the text is ordinary prose on disk and in a terminal, and only a runner
+ # transforms it. It was found by reading one job's annotations through the
+ # API, not by anything in this file.
+ #
+ # Two facts were measured on real runs and the gate's shape follows them:
+ # the legacy `##[...]` form is parsed ANYWHERE in a printed line (the
+ # measured token sat at column 18 and was still consumed), while the
+ # `::...::` form is parsed only at LINE START (two mid-sentence ones print
+ # on every PR from `check-prerelease-pin-watch` and mint nothing). So the
+ # first detector is unanchored and the second is anchored — flagging inert
+ # prose would be a false positive the next author would be right to delete.
+ #
+ # It RUNS the self-tests rather than reasoning about their source, because
+ # "is this token printed?" is only answerable by printing it. A static
+ # prefilter picks which ones to run — over-selecting freely, since the
+ # verdict never comes from it — which is what keeps this step at ~14 s
+ # instead of the ~4 min the whole population costs.
+ #
+ # Invoked as `node scripts/…` rather than through a `pnpm check:*` alias:
+ # see the GATE INVOCATION IDIOM note at the top of this file. Reads
+ # `scripts/` and `.github/workflows/` off disk and spawns the selected
+ # self-tests; no network.
+ - name: Self-test workflow-command gate
+ run: |
+ node scripts/check-self-test-workflow-commands.mjs --self-test
+ node scripts/check-self-test-workflow-commands.mjs
+
  # Verify-lock entry-point self-test (#9661). `scripts/pm/os-verify-lock.sh`
  # is the ONE way an agent takes the container's shared heavy-verify lock,
  # and it is the enforcement of a rule that used to live only in prose: the