fix(design): Aside dump script stays single-quoted; redaction gate sized to the dump cap; doctrine made consistent

- The DOM-dump Aside block was the only double-quoted `aside repl` script in
  the tree (to splice the function text), which put the agent-filled <url>
  inside a double-quoted bash string: a same-origin href carrying $(...) would
  run in the reviewer's shell when Phase 3 opened that page. The script is
  single-quoted like every other Aside script and the function text enters
  through a closed-quote segment ('"$_DUMP"'); the fallback line is
  `$B js '('"$_DUMP"')()'`. A free test pins that no rendered Aside script
  opens with a double quote.
- The persist block capped dumps at 10 MiB but ran gstack-redact with its
  1 MiB default, so every real page between the two was deleted as
  DOM_DUMP_REDACTION_BLOCKED; the gate passes --max-bytes at the dump cap and
  blocks on any exit other than clean (0) or MEDIUM (2), so a redaction tool
  that fails to run can no longer fall through to "persist".
- Dump hygiene removes <template> and <noscript> subtrees (invisible to the
  attribute walk), inline on* handlers, and the cross-origin <link> nodes
  already named in the note, so the file handed to the engine references no
  remote stylesheet.
- Doctrine: the Codex design-voice prompts said "2-3 intentional motions"
  against the one-authored-moment rule; the overused-display heading scoped
  its ban to Persuade/Experience while the catalog and hard rules ban it
  everywhere; design-consultation's Important Rule 4 still said "as primary";
  design-html's blacklist header is now "Never include by default" with the
  mockup/DESIGN.md/user-ask override the catalog grants; the slop gate honors
  Decisions Log and Do's and Don'ts blessings like /review does; the landing
  "poster" line says poster in stance, not type size; the design binary's
  variant dials no longer flip light/dark for variety; gstack's DESIGN.md
  rows name data labels (UI labels stay the DM Sans token) and call the
  skill-bar fill and hovers functional transitions.
- design-review names how the base branch is found (gh pr view, then the
  repo default; never main) for the source-mode scan and the diff-aware mode.
- frontend-scope matches the config globs at the repo root only, like the
  bash arm; the parity test carries nested samples.
- Cleanups: renderCatalog's stale style option, an unused import, the
  identity-map bannedFontNames, the checklist header's "same entries" claim,
  the catalog header's consumer list, the orphaned main() docstring, the
  plan doc's IIFE bullet. design-html's skeleton ceiling is re-measured
  (54,184) for the two doctrine sentences.

Tests: AUTO-FIX rendering from the catalog, the E2E slice markers checked in
the free suite, the hygiene cases for templates/noscript/handlers/remote
links, and the review E2E counting detector rows separately from the seven
checklist plants.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

test/design-checklist-sync.test.ts

@@ -12,7 +12,7 @@ import * as path from 'path';
 import { spawnSync } from 'child_process';
 import {
   generateDesignChecklistMd, checklistSlopEntries,
-  DESIGN_CHECKLIST_HEADER, DESIGN_CHECKLIST_TITLE, DESIGN_CHECKLIST_SLOP_HEADING,
+  DESIGN_CHECKLIST_HEADER, DESIGN_CHECKLIST_TITLE, DESIGN_CHECKLIST_SLOP_HEADING, autoFixEntries,
 } from '../scripts/resolvers/design-checklist';
 import { DESIGN_SLOP_CATALOG, BANNED_FONTS } from '../lib/design-catalog';
 import { AI_SLOP_BLACKLIST } from '../scripts/resolvers/constants';
@@ -41,6 +41,17 @@ describe('review/design-checklist.md is generated', () => {
     }
   });
 
+  test('the Classification AUTO-FIX list renders every auto-fix catalog entry with its id', () => {
+    const md = generateDesignChecklistMd();
+    const block = md.slice(md.indexOf('**AUTO-FIX**'), md.indexOf('**ASK**'));
+    const entries = autoFixEntries();
+    expect(entries.length).toBeGreaterThan(0);
+    for (const e of entries) {
+      expect(e.tier).toBe('auto-fix');
+      expect(block).toContain(`- [${e.impeccableId}] ${e.prose}`);
+    }
+  });
+
   test('category 1 renders every grep-detectable slop entry and every legacy line', () => {
     const md = generateDesignChecklistMd();
     const entries = checklistSlopEntries();
@@ -99,6 +110,28 @@ describe('gen-skill-docs writes the checklist for the Claude host only', () => {
     }
   }, 300_000);
 
+  test('--host claude --out-dir also renders lib/dom-dump.js; a modified out-dir copy flips --dry-run to STALE', () => {
+    const out = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-assets-'));
+    try {
+      const claude = runGen(['--host', 'claude', '--out-dir', out]);
+      expect(claude.status).toBe(0);
+      expect(claude.stdout).toContain('GENERATED: lib/dom-dump.js');
+      const dump = fs.readFileSync(path.join(out, 'lib', 'dom-dump.js'), 'utf-8');
+      expect(dump).toBe(fs.readFileSync(path.join(ROOT, 'lib', 'dom-dump.js'), 'utf-8'));
+      const fresh = runGen(['--host', 'claude', '--out-dir', out, '--dry-run']);
+      expect(fresh.stdout).toContain('FRESH: lib/dom-dump.js');
+      expect(fresh.stdout).toContain('FRESH: review/design-checklist.md');
+      fs.appendFileSync(path.join(out, 'review', 'design-checklist.md'), '\nhand edit\n');
+      fs.writeFileSync(path.join(out, 'lib', 'dom-dump.js'), '// tampered\n');
+      const stale = runGen(['--host', 'claude', '--out-dir', out, '--dry-run']);
+      expect(stale.stdout).toContain('STALE: review/design-checklist.md');
+      expect(stale.stdout).toContain('STALE: lib/dom-dump.js');
+      expect(stale.status).not.toBe(0);
+    } finally {
+      fs.rmSync(out, { recursive: true, force: true });
+    }
+  }, 300_000);
+
   test('--dry-run reports the checklist FRESH', () => {
     const r = runGen(['--dry-run']);
     expect(r.stdout).toContain('FRESH: review/design-checklist.md');