test: wave coverage for sanitizer, link_or_copy, build script, doc drift

Four new test files (29 cases total):

browse/test/server-sanitize-surrogates.test.ts:
  - 11 unit cases for sanitizeLoneSurrogates (passthrough, valid pair,
    lone high/low mid-string, trailing/leading lone, adjacent doubles,
    pair-then-lone, lone-then-pair, empty)
  - 2 bug-repro tests pinning the regression intent (UTF-8 round-trip,
    JSON.parse round-trip with codepoint assertion)
  - 4 wiring invariants asserting the architectural choke points stay
    intact (handleCommandInternalImpl rename, central sanitization
    line, sanitizeReplacer function exists, SSE producers stringify
    with replacer)
  Function extracted from server.ts via regex + eval'd in test scope
  so no production-code export is needed.

test/setup-windows-fallback.test.ts:
  - Static invariant (D7): zero raw `ln` calls outside the
    _link_or_copy helper body and comments
  - Helper-existence assertions
  - 4-cell behavior matrix (file/dir × Windows/Unix) via awk-style
    helper extraction + bash -c sourcing
  - Windows-note printer registration check
  Mirrors test/setup-conductor-worktree.test.ts patterns.

test/build-script-shell-compat.test.ts:
  - Regex assertion that package.json scripts.* contain no bash brace
    groups (Bun-Windows-hostile)
  - Subshell-precedence check for `.version` redirects
  Strips single-quoted strings before regexing so embedded JS code
  inside echo '...' doesn't false-positive.

test/docs-config-keys.test.ts:
  - DEPRECATED_KEYS denylist scanned across docs/**/*.md
  - Round-trip test for `gstack-config get artifacts_sync_mode`
  Defends the v1.27.0.0 rename from doc drift.

Updates to two existing tests:
  - test/setup-conductor-worktree.test.ts: expect `_link_or_copy`
    instead of `ln -snf` at the Conductor-worktree guard call site
  - test/gen-skill-docs.test.ts: same swap at three assertion sites
    (Codex section, Claude link_claude_skill_dirs body, Codex
    link_codex_skill_dirs body)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

test/docs-config-keys.test.ts

@@ -0,0 +1,81 @@
+import { describe, test, expect } from 'bun:test';
+import { spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+
+const ROOT = path.resolve(import.meta.dir, '..');
+const CONFIG_BIN = path.join(ROOT, 'bin', 'gstack-config');
+
+// gstack-config accepts arbitrary keys (free-form YAML store), so we can't
+// build an authoritative set of "valid keys" from the script. Instead, defend
+// the specific invariant this wave introduces: deprecated keys must not
+// reappear in user-facing docs. Extend the denylist as future renames happen.
+const DEPRECATED_KEYS = new Set<string>([
+  // Renamed to artifacts_sync_mode in v1.27.0.0, doc references re-deprecated
+  // in v1.36.0.0 alongside the same rename of *_prompted.
+  'gbrain_sync_mode',
+  'gbrain_sync_mode_prompted',
+]);
+
+function scanDocsForConfigKeys(): { docPath: string; key: string; line: number }[] {
+  const hits: { docPath: string; key: string; line: number }[] = [];
+  const docsDir = path.join(ROOT, 'docs');
+  // Recurse docs/ but skip dotfiles. CHANGELOG.md/TODOS.md are excluded by virtue
+  // of being top-level; we only scan docs/**.
+  const stack = [docsDir];
+  while (stack.length) {
+    const cur = stack.pop()!;
+    for (const ent of fs.readdirSync(cur, { withFileTypes: true })) {
+      if (ent.name.startsWith('.')) continue;
+      const full = path.join(cur, ent.name);
+      if (ent.isDirectory()) {
+        stack.push(full);
+        continue;
+      }
+      if (!ent.name.endsWith('.md')) continue;
+      const text = fs.readFileSync(full, 'utf-8');
+      const lines = text.split('\n');
+      lines.forEach((line, idx) => {
+        // Match `gstack-config set <key>` or `gstack-config get <key>`.
+        for (const m of line.matchAll(/gstack-config\s+(?:set|get)\s+([a-z][a-z0-9_]*)/g)) {
+          hits.push({ docPath: full, key: m[1], line: idx + 1 });
+        }
+      });
+    }
+  }
+  return hits;
+}
+
+describe('docs ↔ gstack-config key drift guard', () => {
+  test('docs/ references at least one config key (smoke)', () => {
+    const hits = scanDocsForConfigKeys();
+    expect(hits.length).toBeGreaterThan(0);
+  });
+
+  test('no doc references a deprecated config key', () => {
+    const hits = scanDocsForConfigKeys();
+    const stale = hits.filter((h) => DEPRECATED_KEYS.has(h.key));
+    if (stale.length > 0) {
+      console.error('Deprecated config keys referenced in docs:', stale);
+    }
+    expect(stale).toEqual([]);
+  });
+
+  test('`gstack-config get artifacts_sync_mode` returns a value (the rename landed)', () => {
+    // Run from a clean HOME so the user's local config doesn't pollute.
+    const tmpHome = fs.mkdtempSync(path.join(require('os').tmpdir(), 'gstack-cfg-'));
+    try {
+      const result = spawnSync(CONFIG_BIN, ['get', 'artifacts_sync_mode'], {
+        encoding: 'utf-8',
+        env: { ...process.env, HOME: tmpHome, GSTACK_HOME: tmpHome },
+        timeout: 5000,
+      });
+      expect(result.status).toBe(0);
+      // A known key returns its default value, not the "unknown key" error string.
+      expect(result.stderr).not.toContain('not recognized');
+      expect(result.stdout.trim().length).toBeGreaterThan(0);
+    } finally {
+      fs.rmSync(tmpHome, { recursive: true, force: true });
+    }
+  });
+});