[codex] fix TS allowlist path normalization

[hyperpolymath]

Root cause

The current compiled checker walks files as ./repo-relative/path, while exemptions parsed from .claude/CLAUDE.md are stored as repo-relative/path. That meant exact-path exemptions such as rescript-ecosystem/packages/core/runtime-tools/bin/rrt.ts did not match the generated .deno.js runtime artifact even though the table row was parsed.

The prime backtick hypothesis was not the full issue in the current source: the row parser already extracted code-span contents. The fix still normalizes parsed exemption cells by trimming and storing repo-relative paths, and it normalizes candidate paths before exact/glob matching.

Fix

• Normalize exemption paths and matched file paths before comparison so ./path and path compare as the same repo-relative file.
• Keep exact entries exact and glob entries regex-backed; no substring fallback was added.
• Keep header/separator rows out of the parsed exemption set.
• Treat .ts.bak / .tsx.bak as blocked TS artifacts so near-miss exemption paths do not slip through.
• Expand the regression harness to run both scripts/check-ts-allowlist.ts and the compiled scripts/check-ts-allowlist.deno.js artifact.

Validation

• scripts/tests/check-ts-allowlist-test.sh passes: 36 assertions across both checker targets.
• Focused repro with rescript-ecosystem/packages/core/runtime-tools/bin/rrt.ts and the approved CLAUDE.md table is clean after the fix.
• just check-ts-allowlist-drift is not clean locally because the current AffineScript compiler also fails to parse the unmodified HEAD source, and the recipe mishandles its temp variables after that failure. The committed .deno.js artifact was therefore patched and validated directly.

Consumer follow-up

New standards commit SHA to pin for this change: 681373b30b3615460ac3c802d6ba8db893b48d45.

Consumers that pin hyperpolymath/standards/.github/workflows/governance-reusable.yml@<sha> need a follow-up pin bump after this lands, including developer-ecosystem and the k9 repos. Note that current main has drifted from 861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613; verify the reusable workflow shape when bumping consumers.