ci(audit-self): wire 4 present-but-unwired install-sh tests + meta-gate — GH #531 audit follow-up

[artyhoo]

Summary

The #531 audit (this session) surfaced 4 install-sh test files that exist but were never invoked by CI — the armed-but-not-fired anti-pattern. A test wired at no channel fails at none, which contradicts the project's "every rule fails at the earliest reachable channel" thesis. Same class as #540 shipping gh-531's test unwired (fixed in #543).

Closes MAJOR-2 (second half) + recommendation #3 from the audit.

Changes (2 files)

• .github/workflows/audit-self.yml — wire the 4 tests as deterministic bash steps (no paid-LLM; compliant with no-paid-llm-in-ci.md):
  • gh-534-arch-boundaries.test.sh
  • gh-535-rule-enforced.test.sh
  • c1-wiring.test.sh
  • ship-orchestration-skills.test.sh
• tests/install-sh/meta-all-wired.test.sh (new) — a meta-gate asserting every tests/install-sh/*.test.sh is wired in audit-self.yml, so this omission can't reland silently. Non-vacuous NEG (removing a wiring from a workflow copy flips the gate). Wired itself → 33/33 install-sh test files now invoked in CI.

Verification

• All 4 tests pass locally (gh-534 9/9, gh-535 7/7, c1-wiring 10/10, ship-orchestration-skills 7/7)
• Meta-gate passes (2/2) — all wired + non-vacuous NEG flips when a wiring is removed
• audit-self.yml is valid YAML; 33 install-sh run steps
• No deliberate-exclusion markers in the 4 tests (non-wiring was an oversight, not intentional); portability-landmine scan clean (no BSD-only sed ranges / mktemp --suffix / unguarded set -u array loops)
• CI confirms the 4 newly-wired tests pass in the GNU/Linux runner (they've never run there — the Principles job is now their first real CI exposure; if one surfaces a portability issue I'll fix it, same as the format:check fails out-of-the-box on ~50 installer-shipped files (npm run validate) — framework doesn't dogfood Prettier #531 NEG in fix(install): conditionally ignore framework configs shipped fresh — GH #531 (reopen, config-mismatch) #544)

Scope notes

• Separate umbrella from fix(install): conditionally ignore framework configs shipped fresh — GH #531 (reopen, config-mismatch) #544 (the format:check fails out-of-the-box on ~50 installer-shipped files (npm run validate) — framework doesn't dogfood Prettier #531 prettier config-mismatch fix). Adds no new test file there, so the meta-gate's count is consistent across both.
• Out of scope (audit follow-ups, separate PRs if you want them): R3 real-depcruise arm (MAJOR-2 first half), the unique_by(.run) SSOT/done.md staleness (MINOR). Consumer install ships framework-internal tooling that no-ops (pipeline / runtime-bridge / packages/core/principles) #482 reopen-vs-defer remains your call.

Prior-art: skipped — CI wiring + a deterministic meta-gate test, no new capability.