Add test coverage for untested GitHub Scripts

[stranske]

Why

Seven core GitHub Action scripts in .github/scripts/ lack dedicated test coverage:

1. agents-guard.js - Critical security guardrail for agents surface
2. agents_pr_meta_orchestrator.js - PR metadata coordination
3. keepalive_guard_utils.js - Keepalive safety utilities
4. keepalive_instruction_template.js - Prompt generation for keepalive
5. keepalive_orchestrator_gate_runner.js - Gate integration for orchestrator
6. keepalive_post_work.js - Post-keepalive cleanup operations
7. merge_manager.js - PR merge automation

These scripts handle critical workflow orchestration and security checks. Without tests, regressions can slip through undetected. The recent API retry integration (PR #151) highlighted how untested code paths can harbor subtle bugs.

Scope

Add comprehensive Node.js test files for the 7 untested scripts listed above. Each test file should:

• Live in .github/scripts/__tests__/ following existing naming conventions
• Use Node.js built-in test runner (node:test)
• Mock GitHub API calls and context objects
• Cover happy path, error handling, and edge cases
• Achieve >80% line coverage for the target script

Non-Goals

• Refactoring the scripts themselves (unless blocking testability)
• Adding Python test coverage (separate effort)
• Integration testing with live GitHub API
• Performance benchmarking

Tasks

Round 1: Security-critical scripts

• Create agents-guard.test.js with tests for label validation, immutable surface checks, and bypass detection
• Create keepalive-guard-utils.test.js covering pause label detection and guard state management

Round 2: Orchestration scripts

• Create agents-pr-meta-orchestrator.test.js testing body section updates and conflict resolution
• Create keepalive-orchestrator-gate-runner.test.js for gate status evaluation and dispatch logic

Round 3: Keepalive utilities

• Create keepalive-instruction-template.test.js validating prompt generation and variable substitution
• Create keepalive-post-work.test.js testing cleanup operations and state transitions

Round 4: Merge automation

• Create merge-manager.test.js covering merge eligibility, conflict detection, and squash behavior
• Run full test suite and verify all new tests pass
• Update test documentation if needed

Acceptance criteria

• All 7 test files exist in .github/scripts/__tests__/
• Each test file has at least 5 test cases covering core functionality
• node --test .github/scripts/__tests__/*.test.js passes with 0 failures
• No regressions in existing tests (Selftest CI workflow passes)
• New tests follow patterns established in existing test files (e.g., api-helpers.test.js)

Implementation notes

Files to create:

• .github/scripts/__tests__/agents-guard.test.js
• .github/scripts/__tests__/keepalive-guard-utils.test.js
• .github/scripts/__tests__/agents-pr-meta-orchestrator.test.js
• .github/scripts/__tests__/keepalive-orchestrator-gate-runner.test.js
• .github/scripts/__tests__/keepalive-instruction-template.test.js
• .github/scripts/__tests__/keepalive-post-work.test.js
• .github/scripts/__tests__/merge-manager.test.js

Reference files for test patterns:

• .github/scripts/__tests__/api-helpers.test.js (mocking patterns)
• .github/scripts/__tests__/agents-belt-scan.test.js (context mocking)
• .github/scripts/__tests__/detect-changes.test.js (GitHub API mocking)

Scripts to analyze for test design:

# View exports and public API of each script
grep -E "^(module\.exports|exports\.)" .github/scripts/agents-guard.js
grep -E "^(module\.exports|exports\.)" .github/scripts/keepalive_guard_utils.js
# ... etc

Testing

After each round of implementation:

1. Run new tests in isolation:

   node --test .github/scripts/__tests__/<new-test>.test.js

2. Run full test suite:

   node --test .github/scripts/__tests__/*.test.js

3. Verify CI passes on the PR

---

[github-actions]

Branch codex/issue-153 created from main.

Option 1 (Invite) is enforced on issue events. PR creation is disabled by design so you are the PR author. Codex only engages on human-authored PRs.

Please open the PR as the author so Codex can work on it:

• Compare link: https://github.com/stranske/Workflows/compare/main...codex/issue-153?expand=1
• Suggested title: Codex bootstrap for #153
• Suggested body (copy/paste):

<!-- meta:issue:153 -->

@codex Your objective is to satisfy the **Acceptance Criteria** by completing each **Task** within the defined **Scope**.

**This round you MUST:**
1. Implement actual code or test changes that advance at least one incomplete task toward acceptance.
2. Commit meaningful source code (.py, .yml, .js, etc.)—not just status/docs updates.
3. Mark a task checkbox complete ONLY after verifying the implementation works.
4. **POST A REPLY COMMENT** with completed checkboxes using the **EXACT TEXT** from the lists below.

**CRITICAL - Checkbox Format:**
When posting your reply, copy the **exact checkbox text** from the Tasks and Acceptance Criteria sections below. Do NOT paraphrase or summarize. The automation matches text exactly.

Example format for your reply:

Completed this round

Tasks

• Add an environment flag (e.g., TREND_PIPELINE_PROXY_SIMPLE) that, when set, skips GC scanning...
• Ensure default behaviour remains unchanged (GC scanning enabled) to preserve test friendliness.

Acceptance Criteria

• Setting the new env flag yields a direct-import proxy path; default continues to honour GC-scanned modules.

**DO NOT:**
- Commit only status files, markdown summaries, or documentation when tasks require code.
- Re-post checklists without making implementation progress.
- Close the round without source-code changes when acceptance criteria require them.
- Paraphrase or shorten checkbox text—copy it exactly for tracking to work.

Review the Scope/Tasks/Acceptance below, identify the next incomplete task that requires code, implement it, then **post a reply comment** with the completed items using their **exact original text**.