ci(static-checks): both rg assertions are false-green — ripgrep is never installed

[thymikee]

The Static Checks job runs two rg assertions on ubuntu-latest, but nothing installs ripgrep and the GitHub-hosted Ubuntu image does not ship it. Both steps fail with rg: command not found, and because each assertion is written as if rg ...; then ... exit 1; fi, a missing binary makes the if condition false — so the step exits 0 and the job reports green.

Both assertions have therefore been vacuous since they were introduced, and one of them is now hiding real violations.

Evidence

From the Static Checks job on a recent PR run (job 97029728691, 8s, reported pass):

Disallow trailing commas before closing parenthesis in Swift
  /home/runner/work/_temp/....sh: line 1: rg: command not found

Fail if test-only DI seams reappear in production code
  /home/runner/work/_temp/....sh: line 1: rg: command not found

Runner image: ubuntu-24.04 / 20260816.277.1.

Running the same two assertions locally with ripgrep installed:

• rg -nU --glob '*.swift' ',\s*\n\s*\)' apple/runner → exit 1, no matches. This one would legitimately pass.
• rg '\?\s*:\s*typeof\s+' src/ --glob '!**/__tests__/**' --glob '!*.test.ts' → exit 0, 6 matches:

src/remote/daemon-proxy.ts:  fetchImpl?: typeof fetch;
src/cli/auth-session.ts:  fetch?: typeof fetch;
src/cli/auth-session.ts:  fetchImpl?: typeof fetch;
src/cli/auth-session.ts:  fetchImpl?: typeof fetch;
src/cli/connection/cloud-profile.ts:  fetchImpl?: typeof fetch;
src/cli/connection/cloud-profile.ts:  fetchImpl?: typeof fetch;

So the gate that exists to stop test-only DI seams from reappearing in production code would be red today if it could run at all.

Regression window

Never worked. The Swift assertion arrived in b79bd86 (#186, 2026-03-06) already written this way with no ripgrep install; #1465 (255deb6, 2026-07-28) folded it and the DI-seams assertion into the shared static-checks job, preserving the same shape. No revision of either job has ever installed rg.

Fix sketch

Two things are wrong and both are worth fixing:

1. The binary is missing. Either install ripgrep in the job, or rewrite the assertions against grep -rP / a small scripts/ checker so the gate has no undeclared external dependency. A repo-owned checker also becomes testable, which the current shell one-liners are not.
2. The shape is unsafe. if <cmd>; then exit 1; fi cannot distinguish "no matches" from "the tool did not run". Even with ripgrep present, rg exit code 2 (bad glob, unreadable path) also reads as pass. The assertion should check for the specific "clean" exit code and treat anything else as an error — a missing or broken tool must fail the lane, not silence it.

Whoever fixes this needs to decide separately what to do about the 6 ?: typeof fetch hits — they may be legitimate HTTP injection seams rather than the test-only DI seams the rule was written to ban, in which case the pattern or its exclusions need narrowing rather than the call sites changing.

Lane framing

• Catches: a CI gate that reports green without ever executing its assertion — the worst failure mode a gate has, because it is indistinguishable from a real pass on the PR status line.
• Evidence: both steps log rg: command not found on every run; the DI-seams assertion has 6 live violations it has never reported.
• Cost: installing ripgrep is one step; hardening the exit-code handling is a few lines, or one small script if the checks move in-repo.
• Kill criterion: if both assertions are retired or subsumed by oxlint/fallow rules, drop the job rather than repairing it.

Found while reviewing CI output for #1967 (the doctor stale-install probe); filing separately per maintainer request so it is not fixed inside that PR.