fix(review): Step 11.5 bind ignores untracked root dot-dir scratch, keeps .github/ and .gstack/ (GST-985)

gstack-review-log and gstack-review-read fingerprint with gstack-wtree --review, which
leaves out root dot-directories that hold no tracked file. A test lane's
.review-units-test-* scratch appearing or vanishing mid-review no longer unbinds the
Step 9 row; .github/ and .gstack/ always count, and every other gstack-wtree caller
keeps the whole tree.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

test/review-start-evidence.test.ts

@@ -166,6 +166,43 @@ describe('review start/end binding (#2803)', () => {
     });
   }
 
+  for (const when of ['created', 'removed']) {
+    test(`GST-985: an untracked scratch dir ${when} mid-review still binds; a tracked edit still breaks it`, () => {
+      const scratchDir = join(repo, '.review-units-test-x');
+      if (when === 'removed') { mkdirSync(scratchDir); writeFileSync(join(scratchDir, 'unit.json'), '{}\n'); }
+      const token = cli('gstack-review-log', ['--start', 'review']);
+      if (when === 'created') { mkdirSync(scratchDir); writeFileSync(join(scratchDir, 'unit.json'), '{}\n'); }
+      else rmSync(scratchDir, { recursive: true, force: true });
+      const row = log(token);
+      expect(row.review_binding.state).toBe('verified');
+      expect(row.review_binding.start_wtree).toBe(row.review_binding.end_wtree);
+      expect(row.review_freshness.status).toBe('CURRENT');
+      expect(git('diff', '--name-only', row.wtree, cli('gstack-wtree'))).toBe(when === 'created' ? '.review-units-test-x/unit.json' : '');
+
+      const edited = cli('gstack-review-log', ['--start', 'review']);
+      writeFileSync(join(repo, 'source.ts'), 'export const unreviewed = true;\n');
+      expect(log(edited).review_binding.state).toBe('changed');
+    });
+  }
+
+  test('GST-985: ignored root dot-directories still fingerprint under --review', () => {
+    writeFileSync(join(repo, '.git', 'info', 'exclude'), '.cache/\n');
+    mkdirSync(join(repo, '.cache'));
+    writeFileSync(join(repo, '.cache', 'blob'), 'x\n');
+    expect(cli('gstack-wtree', ['--review'])).toBe(cli('gstack-wtree'));
+  });
+
+  for (const file of ['.github/workflows/x.yml', '.gstack/ship-policy.json']) {
+    test(`GST-985: an untracked ${file} added mid-review still breaks the bind`, () => {
+      const token = cli('gstack-review-log', ['--start', 'review']);
+      mkdirSync(join(repo, file, '..'), { recursive: true });
+      writeFileSync(join(repo, file), '{}\n');
+      const row = log(token);
+      expect(row.review_binding.state).toBe('changed');
+      expect(git('diff', '--name-only', row.review_binding.start_wtree, row.review_binding.end_wtree)).toBe(file);
+    });
+  }
+
   test('fix commits do not certify the final tree until a new unchanged pass', () => {
     const token = cli('gstack-review-log', ['--start', 'review']);
     writeFileSync(join(repo, 'source.ts'), 'export const fixed = true;\n');

test/size-ledger/ship/gst-985-review-bind-scratch.json

@@ -0,0 +1,4 @@
+{
+  "bytes": 220,
+  "why": "GST-985: review-army says the review snapshot skips untracked root dot-dir scratch but keeps .github/ and .gstack/"
+}