fix(scan/parse): reject the explicit off-pin scan language on a pinned project (#667)

[gadievron]

Summary

openant scan -l <other> (and parse -l <other>) on a language-pinned project previously wrote the other language's scan into the pinned language's directory in place (#667). Per the maintainer's REJECT-now ruling, this PR rejects the explicit off-pin request at the CLI boundary, before any artifact/meta write or Python invocation.

The amendment (the wiring pin)

The original guard was tested at the helper level (TestRejectOffPinLanguage drives rejectOffPinLanguage directly). The wiring — the actual cobra call in runScan/runParse — was not: the E1/E2 class (a PR whose suite passes with the fix's production wiring removed).

This amendment adds two subprocess wiring tests:

• TestOffPinWiringRejectsEndToEnd — drives the real runScan with a jailed HOME + a python-pinned active project + the flag Set() to mark the explicit form. The supported off-pin (go) gets the scan -l auto on a language-pinned project replaces the pinned scan dir's artifacts in place (dataset.json, results.json) while meta keeps the pinned language — recoverable by re-scan; the #274 cosmetic-wart ruling's correctness counter-evidence #667 rejection; the unsupported (cobol) gets the init -l accepts any string: the traversal persists to project.json and escapes the artifacts dir; a typo (-l Python) prints success then fails every later scan #691 message; the pin dir stays clean (no dataset.json). Scope, honestly: the assertion proves the cobra wiring fires — it accepts either rejection message, so the per-case routing (go → scan -l auto on a language-pinned project replaces the pinned scan dir's artifacts in place (dataset.json, results.json) while meta keeps the pinned language — recoverable by re-scan; the #274 cosmetic-wart ruling's correctness counter-evidence #667, cobol → init -l accepts any string: the traversal persists to project.json and escapes the artifacts dir; a typo (-l Python) prints success then fails every later scan #691) is the named residual below, not what this test pins.
• TestOffPinParseWiringRejectsEndToEnd — the same for runParse.

Both tests fail when the guard's call site is removed (the wiring mutants, executed) — the E1 class is killed for both surfaces.

The C4 evidence (the M9-1 wiring clause)

Every prod hunk carries a prod-mutant receipt: the guard neutered (3 tests fail), the exemption inverted (3), the supported-set membership inverted (2), the scan wiring removed (1 — the wiring test), the parse wiring removed (1), the parse defaults wrong (1). Every mutant kills — the tests constrain the behavior.

The declared notes

• Symlink bypass in the output-pin guard (DECLARED RESIDUAL, executed on this head): the guard's filepath.Abs comparison does not resolve symlinks, so a symlinked -o path pointing at the pin directory takes the exemption — the bypass was demonstrated by execution, not by inspection. Two honest notes from the refutation round: (a) the earlier "resolved via $PWD always" severity argument was false (Getwd honors $PWD; there is no demonstrated accidental-resolution path), so this is a deliberate-symlink attacker-side residual, not an accidental one; (b) the in-tree fix is not a naive filepath.EvalSymlinks swap — it errors on not-yet-created output dirs and would introduce false rejections; the in-tree model (internal/server/server.go:1935-1939) resolves both sides before comparing, and a deny-on-error fallback needs its own test. Symlinks stay declared out of scope for this PR; the guard-tightening is future work with that test attached.

• The parse call-site's wiring is now pinned; the helper-level discrimination tests (the -o "" shape, the spelling cases) remain in the original suite.

• The second commit is re-authored to the noreply identity; the first still carries a machine-local author address — declared, metadata-only (M9-5-exempt). Before confirming a squash merge, read the squash-message box and remove any machine-local Co-authored-by trailer.

Fixes #667. Cross-linked: #691 (init's missing validation — its message steers there).

Merge notes (added 2026-10-06)

• Merge any time — independent of the fix(verify): an off-enum Stage-2 verdict is a visible error, never a safe fold (#679) #749 → fix(verify): the consistency-rewritten row reaches its envelope bucket; the CSV exports the Stage-1 verdict (#681+#682) #752 order. It shares no files with those PRs or with any other open PR.
• One thing to do at the click: open the squash-commit message box in the merge dialog and delete any Co-authored-by: line ending in a .local address. One commit on this branch was authored from that address, and the same thing has already written that hostname permanently into master three times (2026-09-21).
• At the click: CI green, no open review conversations.
• After merging, the check that matters: the change is present on master and scan -l auto on a language-pinned project replaces the pinned scan dir's artifacts in place (dataset.json, results.json) while meta keeps the pinned language — recoverable by re-scan; the #274 cosmetic-wart ruling's correctness counter-evidence #667 actually closed. An agent runs this on request.