Tighten the gate drift test and document the unguarded test path

The negative assertion missed the likeliest regression: an unguarded
run: bun run test step in CI, which passes both prior checks while
reintroducing the drift and skipping the projects-dir sandbox. Pin the
anchor to end-of-line and note the guard scope in CONTRIBUTING.

Author: TheGreatAxios

CONTRIBUTING.md

@@ -31,7 +31,9 @@ bun run test
 ```
 
 These match the CI workflow in `.github/workflows/ci.yml`. Run `bun run check`
-(lint, typecheck, build, and the guarded test suite) before opening a PR. Do
+(lint, typecheck, build, and the guarded test suite) before opening a PR —
+`bun run test` alone skips the projects-dir sandbox guard, which only runs
+under `bun run check` and CI. Do
 not substitute a bare `bun test` (it also scans
 `vendor/` and pollutes pass/fail counts).
 

tests/unit/check-gate.test.ts

@@ -28,8 +28,11 @@ describe("check gate", () => {
     expect(guardSource).toContain('"run", "test"');
   });
 
-  test("CI's test job invokes the same script, not a raw bun test command", () => {
+  test("CI's test job invokes the same script, not a raw test command", () => {
     expect(ci).toContain(`run: bun run ${GUARD_SCRIPT}`);
-    expect(ci).not.toMatch(/^\s*run: bun test /m);
+    // An unguarded suite step here would reintroduce the local-green/CI
+    // mismatch (and skip the projects-dir sandbox) this gate exists to prevent.
+    expect(ci).not.toMatch(/^\s*run: bun test(\s|$)/m);
+    expect(ci).not.toMatch(/^\s*run: bun run test(\s|$)/m);
   });
 });