build(ci): wire manifest:drift-check into the test:ci chain

[JSONbored]

Summary

Closes #4008.

• Nothing in CI caught the bundled fallback YAML (GITTENSORY_REPO_FOCUS_MANIFEST_YAML in src/config/gittensory-repo-focus-manifest.ts) silently diverging from the real root .gittensory.yml once someone edited one and forgot the other. The bundled string exists so the focus-manifest engine still has a sane default when the live repo file is unreachable (local dev, pre-merge branches).
• Adds scripts/check-manifest-drift.mjs: parses both with the yaml package (already a dependency) and deep-compares the resulting objects (not raw text, so comment-only/whitespace-only edits in either file never false-fail), with a hand-authored .d.mts sidecar matching this repo's existing convention for .mjs scripts imported by tests (see check-docs-drift.d.mts, check-schema-drift.d.mts, etc.).
• Wires npm run manifest:drift-check into test:ci.

Test plan

• npm run typecheck — clean
• npx vitest run test/unit/check-manifest-drift-script.test.ts — 7/7 passed, including a real subprocess run against the actual current repo state (confirms no live drift today)
• npm run manifest:drift-check — passes against the real repo
• npm run command-reference:check — clean, no drift from the new script

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-07 13:09:38 UTC}

4 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review: This PR changes guardrail-protected path(s): package.json (matched package.json), package.json (matched **/package.json).

Review summary
This PR adds `scripts/check-manifest-drift.mjs`, a small pure-function drift checker that deep-compares the parsed root `.gittensory.yml` against the bundled `GITTENSORY_REPO_FOCUS_MANIFEST_YAML` fallback constant, comparing sorted-key JSON so comment/whitespace/key-order differences don't false-fail. It's wired into `test:ci` via a new `manifest:drift-check` npm script, ships a hand-authored `.d.mts` sidecar consistent with the repo's existing pattern for `.mjs` scripts imported from `.ts` test files, and includes a real-subprocess regression test plus unit tests for the add/change/agree cases. This is a narrow, low-risk CI-tooling addition closing #4008 with no schema or migration surface, and the diff is internally coherent with the PR description.

Nits — 6 non-blocking

• scripts/check-manifest-drift.mjs:69 — the flagged control-flow depth (5, threshold 4) inside `main()`'s `if (failures.length > 0)` branch is trivial but could be flattened by extracting the failure-printing loop into a helper.
• scripts/check-manifest-drift.mjs — `readFileSync` in `defaultReadFile` isn't wrapped in a try/catch, so a missing `.gittensory.yml` (e.g. a misconfigured checkout) surfaces as a raw ENOENT stack trace instead of a clear 'root manifest not found' CI message; consider catching and rethrowing with context.
• scripts/check-manifest-drift.mjs — `sortKeysDeep` only sorts object keys, not array element order, so if `wantedPaths`-style array fields are ever legitimately reordered between the two files without a semantic change, this will still report drift; worth a one-line comment noting arrays are compared order-sensitively by design.
• No test exercises the `readFile` throwing / file-not-found path, so that branch is currently uncovered.
• Add a unit test asserting `checkManifestDrift` propagates or wraps a `readFile` throw, to cover the untested error path noted above.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#4008
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 51 registered-repo PR(s), 43 merged, 570 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 51 PR(s), 570 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 51 PR(s), 570 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.58%. Comparing base (c899c3c) to head (11c869a).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4042   +/-   ##
=======================================
  Coverage   93.58%   93.58%           
=======================================
  Files         382      382           
  Lines       35534    35534           
  Branches    13028    13028           
=======================================
  Hits        33253    33253           
  Misses       1618     1618           
  Partials      663      663           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.