test(selfhost): validate-selfhost-sourcemap.mjs has no unit-test seam despite gating every self-host release

[JSONbored]

Context

scripts/validate-selfhost-sourcemap.mjs verifies the self-host Docker build's dist/server.mjs and
dist/server.mjs.map are structurally valid and actually resolve back to real repository source (not
an empty/broken source map) — this gates error.stack symbolication for every self-hosted deployment,
per Sentry's own source-map requirements. It runs on both the dry-run and real build paths of
.github/workflows/release-selfhost.yml (lines 141, 192) and again in .github/workflows/selfhost.yml
(line 103), and is itself in that second workflow's own path filter. It has 8 distinct failure
conditions (missing bundle/map file, missing sourceMappingURL comment, invalid JSON, wrong source-map
version, empty sources, sourcesContent length mismatch, missing/empty src/server.ts entry,
missing/empty repository-relative sources) and zero test coverage of any of them today — a regression
in this check (either a false-pass that lets a broken source map into a release, or a false-fail that
blocks every self-host release on a good build) would only surface live, against a real build.

Requirements

• Refactor the script's validation logic into a testable, injectable function (e.g.
  validateSourcemap({ bundlePath, mapPath, readFile, exists }) or equivalent), following the
  injectable-dependency pattern already used elsewhere in this repo's script tests (e.g.
  check-miner-package.mjs's readContent/pack parameters).
• Add test/unit/validate-selfhost-sourcemap-script.test.ts with one case per existing failure branch:
  missing bundle, missing map, missing sourceMappingURL comment, invalid map JSON, wrong version,
  empty sources, sourcesContent length mismatch, missing src/server.ts in sources, empty content
  for src/server.ts, no ../src/-prefixed sources, and empty content for a repo-relative source —
  plus one passing case with a well-formed minimal source map.
• Preserve the script's current CLI behavior (reads dist/server.mjs/dist/server.mjs.map relative to
  process.cwd(), exits 1 with a console.error message on any failure) — this is a testability
  refactor, not a behavior change.

Deliverables

• Validation logic is testable via injectable file-read/exists functions
• test/unit/validate-selfhost-sourcemap-script.test.ts covers all 8+ failure branches plus a
  passing case

Test Coverage Requirements

scripts/** is not in vitest.config.ts's coverage.include; Codecov's patch gate doesn't apply
numerically, but the new test file must be real, cover every named branch above, and pass under
npm run test:unit.

Expected Outcome

A regression in self-host's source-map validation — in either direction — is caught by
npm run test:unit before it reaches release-selfhost.yml, instead of only being discoverable by a
real (or broken) self-host release build.

Links & Resources

scripts/validate-selfhost-sourcemap.mjs, .github/workflows/release-selfhost.yml:141,192,
.github/workflows/selfhost.yml:103.

[linear-code]

JSO-5317