#3969 refactor(gates): one owner for the allowed pack-stub list

Summary

Follow-up to #3956 (merged). Its final review asked for one owner of the allowed pack-stub list: assertPublishPackageContents in scripts/size-report-package.mjs derived stub paths from Package.swift test targets, while testOnlyPathFailures in scripts/lib/shipped-test-code.ts kept a second hardcoded copy.

scripts/size-report-package.mjs now declares DOCUMENTED_PACK_STUBS and both consumers read it: the publish check's Tests/ exclusion (previously a PackStub.swift suffix match, now membership in the declared list — strictly stronger: an undeclared stub path under Tests/ fails), and the package-wide no-test-code path guard, which imports the list. The declared list stays the owner rather than manifest derivation, keeping the guard fail-closed: a new test target's stub must be declared, not auto-admitted. The owner sits in the .mjs because the Bundle Size base lane runs bare node 22.12 over copied scripts/size-report*.mjs only.

Touched files: 4 (+24/−18), plus the .d.mts type surface.

Validation

• pnpm vitest run over shipped-test-code, size-report-package, macos-helper-package-contents, runner-fixture-host-lookup — 16 pass.
• Falsified: injecting apple/macos-helper/Tests/AgentDeviceSneakyTests/PackStub.swift into the fixture pack now throws where the suffix rule let it pass.
• pnpm typecheck, pnpm lint, pnpm format, check:affected --run --head <sha> below.
• Unresolved risks: none; no runtime behavior changes outside the two publish/guard checks.

🤖 Generated with Claude Code