feat(ci): add floor-node-smoke exact-floor override gate

[John-David Dalton (jdalton)]

Adds a floor-node-smoke CI job that side-installs the exact engines.node floor (sha256-verified against nodejs.org before extraction) and dynamic-imports every packages/npm/* override under it, catching newer-than-floor syntax that current-line CI misses. A floor-node-pin-matches-engines check (auto-registered into check --all) keeps the pin and the overrides' declared floor in lock-step.

The original goal of inlining ci.yml is dropped — main already inlined it via a more-hardened inline git-fetch bootstrap, so this PR is rescoped to just the new gate layered on top of main's current workflow.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

Done

Or push these changes by commenting:

@cursor push 618d9c7c26

Preview (618d9c7c26)

diff --git a/scripts/npm/floor-node-smoke.mts b/scripts/npm/floor-node-smoke.mts
--- a/scripts/npm/floor-node-smoke.mts
+++ b/scripts/npm/floor-node-smoke.mts
@@ -26,6 +26,8 @@
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger/default'
 import { spawnSync } from '@socketsecurity/lib-stable/process/spawn/child'
 
+import { isMainModule } from '../fleet/_shared/is-main-module.mts'
+
 const logger = getDefaultLogger()
 
 // The floor is the low edge of packages/npm/*'s `engines.node: >=24` range.
@@ -72,7 +74,8 @@
  * materializes at the archive path, let alone extracts.
  */
 async function ensureFloorNode(): Promise<string> {
-  const platKey = `${process.platform}-${process.arch}`
+  const platform = process.platform === 'win32' ? 'win' : process.platform
+  const platKey = `${platform}-${process.arch}`
   const pin = FLOOR_NODE_PLATFORMS[platKey]
   if (!pin) {
     throw new Error(
@@ -208,7 +211,7 @@
 
 // Entrypoint-guarded: floor-node-pin-matches-engines (check --all) imports
 // FLOOR_NODE_VERSION from this module, which must not trigger a download.
-if (process.argv[1] && import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   main().catch((e: unknown) => {
     logger.error(e)
     process.exitCode = 1

diff --git a/scripts/repo/check/floor-node-pin-matches-engines.mts b/scripts/repo/check/floor-node-pin-matches-engines.mts
--- a/scripts/repo/check/floor-node-pin-matches-engines.mts
+++ b/scripts/repo/check/floor-node-pin-matches-engines.mts
@@ -22,6 +22,7 @@
 
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger/default'
 
+import { isMainModule } from '../../fleet/_shared/is-main-module.mts'
 import { FLOOR_NODE_VERSION } from '../../npm/floor-node-smoke.mts'
 
 const logger = getDefaultLogger()
@@ -118,6 +119,6 @@
   return 0
 }
 
-if (process.argv[1] && import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   void main()
 }

_{You can send follow-ups to the cloud agent here.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6ee94a7. Configure here.}

[cursor]

Entrypoint guard never runs main

High Severity

The import.meta.url guard in floor-node-smoke.mts prevents main() from executing when invoked with relative paths, on Windows, or via symlinks. This causes the script to exit successfully without running its checks, resulting in a silent false positive for the floor node smoke test.

 

^{Reviewed by Cursor Bugbot for commit 6ee94a7. Configure here.}

[cursor]

Windows floor pin key mismatch

High Severity

The ensureFloorNode function currently fails on Windows. The platKey it constructs (win32-x64) doesn't align with the win-x64 entry in FLOOR_NODE_PLATFORMS, so it can't find the correct Node.js binary to download and install, leading to a script error.

 

^{Reviewed by Cursor Bugbot for commit 6ee94a7. Configure here.}

[cursor]

Smoke passes with zero imports

Medium Severity

The gate only fails when failures is non-empty. If every override is skipped or none are imported, it still exits 0, so a broken resolver or empty package scan stays green while proving nothing — the same silent-empty class this PR fixed for the fleet Test job.

 

^{Reviewed by Cursor Bugbot for commit 6ee94a7. Configure here.}