* test(package): reject an Electron install takeover by exact command
CodeRabbit was right about #20787. Replacing the pinned postinstall string
with a /electron/i keyword check was wrong in both directions, verified:
rebuild-native-deps.mjs && rebuild-native-deps.mjs PASSED (should fail)
rebuild-native-deps.mjs && check-electron-version FAILED (should pass)
The owner's own path contains no "electron", so duplicating it slipped
through -- the one case the contract is named for. And a substring match
rejects any later step that merely mentions Electron, which is the same
over-tightness that broke every open PR in the first place, relocated.
Later steps are now checked against the exact owned command plus the known
Electron install commands. A second case pins the rejections themselves,
because reading the real postinstall cannot show a bad chain would be caught
-- that is how #20787 shipped with a guard that did not guard.
Split into its own file rather than adding a max-lines disable (AGENTS.md).
* test(package): match install commands as tokens and cover the rebuild:electron alias
Both review comments were right, verified by running them:
&& check-install-app-deps-version.mjs rejected by substring match (should pass)
&& pnpm run rebuild:electron slipped through (should fail)
package.json:101 aliases rebuild:electron to the owned script, so invoking it
is the same takeover. Matching is now token-based with the owned command still
checked as a phrase, and both cases are pinned.
