fix(drift): check paths in every scaffold file, not only ROUTER.md

[Yashasvi2229]

What

Makes checkPaths trustworthy enough to run on the whole scaffold, then runs it there.

#80 scoped path checking to ROUTER.md because inline code in the other files produced false MISSING_PATH errors. That stopped the noise but left ten of the eleven scaffold files unchecked — a path could rot in context/ or patterns/ and nothing said so.

Widening the scope alone does not work. Done on its own it takes a real scaffold from 75/100 to 0/100 with 56 errors, because the failures are about resolution, not scope. So this change does both halves:

Extraction stops claiming values that were never file references — home locations (~/.claude/projects), globs (.mex/graph.db*), anything containing whitespace (nodemon src/index.ts), and elided shapes (api/...).

Resolution learns where documentation actually points:

• a scaffold file naming another scaffold file, since the project search deliberately skips .mex/ and so never found INDEX.md or a pattern
• a path written from a subproject's own root — routes/quiz.ts when the file is at server/src/routes/quiz.ts
• generated state the repository ignores, which is absent from a clean checkout by design and documented precisely because mex writes it
• API routes and placeholders (documents/upload, owner/repo), which are shaped like relative paths but whose first segment names nothing
• naming-convention examples such as PascalCase.tsx

Dependencies get the same treatment. Every bold span under a stack heading became a dependency claim, and only the first text child was read, so an entry naming its packages in code claimed a package called "Radix UI + " and dropped the real ones. Now only bold that opens a list item declares a dependency, the packages it names in code are the claim, and a prose description like Supabase (Postgres + Auth) claims nothing. Package managers are not dependencies, and a second application in a subdirectory has its own manifest, which is now read.

Why

Closes #107.

This PR carries @miloquinn's #83 as its first commit, with the change requested in review applied on top: DOTTED_KEY_WITH_SLASH allowed the dotted segment to be empty, so it matched .github/CODEOWNERS, .github/workflows and .mex/ROUTER.md as readily as argocd.argoproj.io/sync-wave — which would have dropped mex's own scaffold paths out of the check. Requiring a real character before the dot fixes it; the regression test @theDakshJaitly asked for is included.

Type of change

• Bug fix
• New feature
• Refactor
• Docs
• CI/Tooling

How to test

Run mex check on a populated scaffold before and after. On a real v0.8 scaffold with a Next.js frontend and an Express backend in a subdirectory:

Before: 54/100 — 1 error, 12 warnings. The error is youtubei.js, an npm package named in prose, reported as a missing file. The warnings are dependency claims made of connective punctuation: ", ", " + ", "Groq (", "Radix UI + ".

After: 100/100 — 0 errors, 0 warnings, while checking paths in all eleven scaffold files instead of one.

To see the widened scope find something real, run it on a scaffold whose docs have drifted — expect a MISSING_PATH for a package documented under a name nothing declares, reported from a file that is not ROUTER.md.

Checklist

• Tests pass (npm test) — see note below
• No breaking changes (or documented below)
• Tested locally with a real project

Note on npm test: the drift suites pass in full — 117 tests across claims and checkers, 23 in public-api — and npm run typecheck is clean. The full suite does not pass on this branch, but it does not pass on main either. Measured with a hermetic TMPDIR, main fails 47 and this branch fails 41; comparing failures by name, the only branch-only failure is cli.test.ts :: built CLI main-module guard …, which passes in isolation and exercises Team JSON parsing, not drift. The same test flaked on the previous drift PR and on runs of main.

Behaviour change: runDriftCheck now reports MISSING_PATH from any scaffold file. public-api.test.ts pinned the old ROUTER.md-only contract and has been updated rather than removed; its other two cases now assert something stronger — a context file is checked, and its config values are correctly not read as paths.

Verified against three real scaffolds, main build vs this branch:

Scaffold	main	this branch
fresh scaffold from templates/	100/100	100/100
populated v0.8 scaffold	54/100 (1E, 12W)	100/100 (0, 0)
populated v0.7 scaffold	78/100 (1E, 4W)	60/100 (4E, 0W)
this repo	8E, 11W	8E, 12W

The v0.7 scaffold drops because the widened check finds real drift that ROUTER.md-only scoping hid: it documents a workspace package under a name nothing declares, and points at a .mex/sync.sh that no longer exists. Every one of the v0.8 scaffold's thirteen findings, by contrast, was false.

Code-graph changes

• This PR targets main
• A linked issue agrees on the bounded extractor/resolver scope
• The change follows the frozen LanguageExtractor or FrameworkResolver interface
• A focused fixture and assertions for the expected node/edge shape are included
• Any new grammar WASM, extension mapping, extractor, or resolver is registered
• No graph identity, reconciliation, schema, or drift-semantics changes are included, or a core / discuss-first issue is linked above