scripts(checks): BRANDING_DRIFT_PATHSPECS' `**/*` globs skip every file directly under src/, so discovery-index is scanned not at all

[JSONbored]

⚠️ Definition of Done: this issue must be completed in full, in a single PR. Do not split this
work across multiple PRs, and do not defer any Deliverable below to a follow-up issue. A PR that
satisfies only some of the Deliverables, stubs a required test, or leaves a checkbox
partially-done does NOT resolve this issue and will be closed.

Context

scripts/check-branding-drift.ts guards runtime source against the pre-rebrand "gittensory" string creeping
back in (the #6786 incident: a hardcoded MCP resource URI left on the old value). Its header says it is
"Scoped to executable code in src/** and each workspace package's bin/, lib/, src/, scripts/ dirs".
The pathspecs are:

// scripts/check-branding-drift.ts:30-45
export const BRANDING_DRIFT_PATHSPECS = [
  "src/**/*.ts",
  "src/**/*.tsx",
  "packages/*/bin/**",
  "packages/*/lib/**/*.js",
  "packages/*/lib/**/*.ts",
  "packages/*/src/**/*.ts",
  "packages/*/src/**/*.tsx",
  "packages/*/scripts/**/*.mjs",
  "apps/*/src/**/*.ts",
  "apps/*/src/**/*.tsx",
  "apps/*/scripts/**/*.mjs",
  ...

These are handed straight to git grep -ciI ... -- <pathspecs> at scripts/check-branding-drift.ts:65.
Without :(glob) magic, git pathspecs are plain fnmatch without FNM_PATHNAME: * already matches /,
and a literal / in the pattern must be matched by a literal / in the path. So src/**/*.ts requires at
least two / characters after src — it matches src/api/routes.ts but not src/index.ts.

Reproduce, in a clean checkout:

$ git ls-files 'src/**/*.ts' | grep -x 'src/env.d.ts'   # -> no output
$ git ls-files 'src/*.ts'    | grep -x 'src/env.d.ts'   # -> src/env.d.ts

What is silently unscanned today:

• The 9 files directly under src/, including src/index.ts (the Worker's fetch/queue/scheduled
  entry), src/server.ts (the self-host entry), src/types.ts and src/queue-intelligence.ts.
  src/env.d.ts contains 3 "gittensory" lines and src/server.ts contains 3 — neither appears in
  scripts/branding-drift-baseline.json, because neither is ever grepped.

• Every file directly under packages/*/src/ (git ls-files 'packages/*/src/*' | awk -F/ 'NF==4' | wc -l
  reports 114 today). This includes all 14 files of
  packages/discovery-index/src/ — that package has no subdirectories under src/, so zero of its files
  are scanned. .github/workflows/ci.yml:444-445 states the opposite as the reason the job is gated on the
  discoveryIndex path filter:

  discoveryIndex: BRANDING_DRIFT_PATHSPECS includes "packages//src/**/.ts", which matches
  packages/discovery-index/src/**.

  Check it: git ls-files 'packages/*/src/**/*.ts' | grep discovery-index returns nothing.
  packages/loopover-contract/src/ is likewise scanned only for its tools/ subdirectory —
  packages/loopover-contract/src/cli-config.ts has 2 unscanned "gittensory" lines.

• The 5 packages/loopover-mcp/lib/*.ts files, for the same reason (packages/*/lib/**/*.ts).

• Files directly under apps/*/src/ (e.g. apps/loopover-ui/src/main.tsx).

packages/*/bin/** is unaffected — a bare ** tail matches everything below the literal prefix.

This is the third variant of the same class: #7095 (apps/* excluded entirely) and #8657 (.tsx siblings
missing) were both fixed by adding pathspecs; the depth restriction was never noticed.

Requirements

• Every pathspec in BRANDING_DRIFT_PATHSPECS that currently uses a **/ path segment must be changed so it
  matches files at every depth under its root, including depth 0 (directly inside the root directory).
  Concretely: src/**/*.ts -> src/*.ts, packages/*/src/**/*.tsx -> packages/*/src/*.tsx, and so on for
  every affected entry. (A git pathspec * already matches /, so the single-star form is the recursive
  form; do not add :(glob) magic, which would change the semantics of every other entry in the list.)
• packages/*/bin/** and the three :(exclude) entries must NOT change — they already behave correctly.
• The set of file extensions scanned must not widen: .md, .json, .css, .sql and every test file
  must stay out, exactly as the header comment describes.
• scripts/branding-drift-baseline.json must be regenerated (npm run branding-drift:update) and committed
  in the same PR. The regenerated baseline must gain exactly these three entries and change nothing else:
  packages/loopover-contract/src/cli-config.ts: 2, src/env.d.ts: 3, src/server.ts: 3.
• The stale claim in .github/workflows/ci.yml:444-445 must be corrected to describe what the pathspecs
  actually match after the fix.
• npm run branding-drift:check must exit 0 on the resulting tree.

⚠️ Required pattern: this is a one-line-per-entry edit to BRANDING_DRIFT_PATHSPECS plus a regenerated
baseline — the same shape as the fix in #8657 (679ba7842). What does NOT satisfy this issue: (a) adding a
second set of X/*.ts entries alongside the existing X/**/*.ts ones, which leaves a list where half the
entries are dead and the next reader copies the broken form; (b) hand-editing
scripts/branding-drift-baseline.json instead of running npm run branding-drift:update;
(c) "fixing" the three newly-surfaced files by deleting their "gittensory" references — they are
legitimate historical references and the baseline exists to grandfather exactly those; (d) a PR that
broadens the pathspecs but leaves the baseline stale, which makes npm run branding-drift:check red.

Deliverables

• BRANDING_DRIFT_PATHSPECS in scripts/check-branding-drift.ts contains no **/ path segment except in
  packages/*/bin/** and :(exclude)packages/*/test/**.
• scripts/branding-drift-baseline.json regenerated and committed; git diff on it shows exactly three
  added keys (packages/loopover-contract/src/cli-config.ts, src/env.d.ts, src/server.ts) and no
  removals or count changes.
• .github/workflows/ci.yml's discoveryIndex justification comment (lines 444-445) states accurately
  that packages/*/src/*.ts matches packages/discovery-index/src/'s files.
• A regression test at test/unit/check-branding-drift-script.test.ts named for this bug that asserts,
  against the exported BRANDING_DRIFT_PATHSPECS, that a depth-0 path is covered: for each of src/,
  packages/<x>/src/, packages/<x>/lib/ and apps/<x>/src/, a representative file directly inside it
  (e.g. src/index.ts, packages/discovery-index/src/app.ts) matches at least one non-exclude pathspec,
  and a nested file (e.g. src/api/routes.ts) still does. Implement the match with the same
  no-FNM_PATHNAME semantics git uses (* matching /), so the assertion fails against the pre-fix list.

All Deliverables above are required in a single PR. A PR that satisfies only some of them — for example one
that edits the pathspecs and regenerates the baseline but skips the regression test, so the next **/
reintroduction is invisible again — does not resolve this issue.

Test Coverage Requirements

This repo enforces 99%+ Codecov patch coverage, branch-counted. vitest.config.ts's coverage.include
covers src/**/*.ts, packages/loopover-engine/src/**/*.ts, packages/loopover-{miner,mcp}/{lib,bin}/**/*.ts,
packages/loopover-contract/src/**/*.ts and packages/discovery-index/src/**/*.ts. It does not cover
scripts/**, and codecov.yml's ignore: list names scripts/** explicitly — Codecov does not gate the
patch on this change, and .github/workflows/** and scripts/branding-drift-baseline.json are not graded
either.

The test is still mandatory and still gating: the root vitest suite (include: ["test/**/*.test.ts"]) runs
test/unit/check-branding-drift-script.test.ts on every PR and a failure there is a red required check.

Because the change is to a data list rather than to control flow, the "both arms" requirement applies to the
matcher assertions: for every root in the list the test must assert one path that MUST match (depth 0) and one
that MUST NOT (a path outside the root, e.g. docs/index.ts), plus one nested path that must still match, so
neither over- nor under-broadening can pass. The existing diffBrandingBaseline tests (increased / decreased /
unchanged) must all continue to pass unmodified.

Expected Outcome

npm run branding-drift:check actually scans the Worker entry point, the self-host entry point, every
packages/discovery-index/src/ module, packages/loopover-mcp/lib/'s five modules and every other file that
sits directly inside a scanned root — closing a hole that made the discoveryIndex CI gate a no-op and left
8 "gittensory" lines in shipped runtime source ungoverned by the baseline.

Links & Resources

• scripts/check-branding-drift.ts:30-45 — BRANDING_DRIFT_PATHSPECS
• scripts/check-branding-drift.ts:65 — where they are passed to git grep
• scripts/branding-drift-baseline.json — the baseline to regenerate
• .github/workflows/ci.yml:444-445 — the incorrect discoveryIndex justification
• test/unit/check-branding-drift-script.test.ts — the existing test file
• check-branding-drift.mjs's BRANDING_DRIFT_PATHSPECS excludes every apps/* workspace, including apps/loopover-ui's own live 'gittensory' references #7095, fix(scripts): check-branding-drift.ts scans packages/*/src/**/*.ts but not the matching .tsx files #8657 — the two earlier pathspec-coverage fixes to this same list

[linear-code]

JSO-7020