* chore(open-knowledge): test-file naming convention and CI guard maintenance

Standardize a consistent suffix convention across the engine test files and add CI guards (each with a planted-positive self-test) plus a lint rule and fixtures. Reference-path and configuration upkeep across the affected packages.

Internal test and CI tooling only. Engine source, the published CLI, and the desktop build inputs are unchanged; no public API, schema, or runtime behavior change.

* fix(open-knowledge): guard desktop .app scan against a dangling symlink

findAppBundles fell through to statSync(top) after the existsSync-guarded
isAppDir returned false, so a broken symlink (or a racing unlink) in the output
dir threw an uncaught ENOENT. Guard the statSync with existsSync like the sibling
checks; add a dangling-symlink regression test.

* fix(ci): build native-config fresh in the OK test cell + decouple TOML tests from the backend

native-config's napi .node is host/toolchain-specific and git-ignored; a turbo
build cache hit (Rust inputs unchanged) can restore a stale/unloadable binary and
skip napi build, so getTomlConfigEngine silently falls back to smol-toml and the
init/Codex TOML tests flake (i64 -> decline, format-preserving edit lost). Force a
fresh native build (bypassing the cache) + assert the binding loads/executes before
the suites, and skip the native-only assertions when the addon is unavailable so a
fallback host doesn't red them (the fallback dispositions stay covered by the forced
() => null engine tests).

* chore(ci): tighten guard step-detection and widen desktop-smoke triggers

- check-mirror-gate-reach: scope step-command detection to each step's run:
  scalar (not the name/env/comment text), so a renamed run: command that
  leaves the old string in the step name no longer registers the step as
  present. Add a planted-evasion test that plants the command in a step
  name: without run: and asserts the removal is still flagged.
- public-open-knowledge-validation: desktop-smoke now also triggers on
  copybara manifest changes. desktop-smoke validates the materialized
  export and is the desktop floor gate; the manifest defines that export,
  so a manifest-only change that breaks the desktop build closure must run
  it. Manifest-only PRs are rare, so the macOS cost stays bounded.
- knip.config: genericize a dependency-ignore comment (drop a stale
  file-path reference).

* test(ci): cover runScalarText block-scalar path + trigger/positive-control edges

- check-mirror-gate-reach.test: exercise runScalarText's block-scalar run: |
  branch (positive + name-only evasion), and the inline-flow
  on: [pull_request, ...] trigger form.
- check-mirror-export-faithful.test: assert a markdown .test.ts/.e2e.ts alone
  does not satisfy the engine-source positive control.

GitOrigin-RevId: 66ed7c5fe88fd44027d740401c30d3a393d9d0d2