fix(ci): correct dependency watch terminal state

[saagpatel]

What

• Replace the inline dependency-watch completion emitter with a tested helper.
• Emit canonical terminal-state and nested readback timestamps for clean, issue-bearing, and partial outcomes.
• Add focused contract tests.

Why

The scheduled dependency-watch run produced an invalid terminal receipt, so the global automation freshness checker could not accept it as qualifying burn-in evidence.

How

The workflow now passes collected audit results to .github/scripts/dependency_watch_completion.py, which computes the canonical status and readback shape without changing dependency scanning behavior.

Testing

• 8/8 dependency-watch completion tests passed.
• Canonical burn-in validator accepted clean, issue-bearing, and partial fixtures with zero violations.
• Frontend standard suite: 279 passed.
• Playwright smoke, visual, accessibility, and responsive suites passed.
• Rust suite: 312 passed, 0 failed, 1 ignored; integration and doc tests passed.
• Production build, workflow drift, git guards, and gitleaks passed.
• Bundle-size gate passed at +3.74%.

Performance impact

No frontend or runtime code changes. Bundle-size gate passed. The required local build-time comparison remains non-green and noisy: observed +23.74%, +15.82%, +59.89%, and +68.26% against the stored 15% threshold. This PR must not be merged until that required gate is green or its baseline is separately and legitimately dispositioned.

Risks

• The workflow schedule cannot produce qualifying evidence until this reaches the default branch.
• Two authentic scheduled runs are still required before automation health can be claimed.
• Terminal-state mapping is covered by focused tests, but live GitHub readback remains pending.

Lockfile rationale

No lockfiles are included in this PR. Existing unrelated lockfile changes remain uncommitted in the local checkout.

Screenshots

Not applicable; no UI changes.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ee91f18ccf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update the contract checker for the extracted emitter

This repo's scripts/ci/check-dependency-watch-contract.mjs still reads only .github/workflows/dependency-watch.yml and requires the AutomationTerminalStateV1 marker plus the partial = issue_attempted and not readback_verified formula; after this line delegates to the new Python file, those strings are no longer in the workflow. I ran node scripts/ci/check-dependency-watch-contract.mjs and it now fails with dependency-watch contract missing: machine completion state, partial mutation accounting, so pnpm check:dependency-watch-contract/health:repo:checks is blocked until the checker is updated to inspect the extracted script or the workflow keeps those contract markers.

Useful? React with 👍 / 👎.