test(srt): guard srt-settings.json against drifting off the pack

Two static checks. The provenance marker check needs no pack checkout so
it always runs; the byte-for-byte drift check needs one and reports SKIP
(exit 93) without it, so a developer machine without the sibling clone
does not go red.

CI now checks out cheshirecode/srt-policy-packs into .srt-policy-packs
and passes SRT_POLICY_PACKS, so the drift check actually runs there. A
check nothing runs is not coverage.

Proved red three ways before landing:
  del(._source)                    -> 2 fail (marker + drift)
  allowedDomains += evil.example   -> 1 fail (drift), marker still PASS
  no pack checkout                 -> SKIP, 9 pass 0 fail

Author: cheshirecode

.github/workflows/ci.yml

@@ -13,9 +13,18 @@ jobs:
     timeout-minutes: 3
     steps:
       - uses: actions/checkout@v4
+      # srt-settings.json is a vendored render of the srt-policy-packs
+      # generic-agent pack. Without this checkout the drift check SKIPs and
+      # a hand-edit of the policy would sail through CI unnoticed.
+      - uses: actions/checkout@v4
+        with:
+          repository: cheshirecode/srt-policy-packs
+          path: .srt-policy-packs
       - name: Install shellcheck
         run: sudo apt-get update -qq && sudo apt-get install -y shellcheck
       - name: Run static suite
+        env:
+          SRT_POLICY_PACKS: ${{ github.workspace }}/.srt-policy-packs
         run: ./tests/run.sh static
 
   build-and-functional:

.gitignore

@@ -18,3 +18,4 @@ id_ecdsa
 
 # macOS
 .DS_Store
+.srt-policy-packs/

tests/run.sh

@@ -95,6 +95,26 @@ json.loads(t)
   else
     fail "mounts.env references no seccomp profile"
   fi
+
+  # srt policy provenance. srt-settings.json is a vendored render of the
+  # srt-policy-packs generic-agent pack; a hand-edit here silently forks the
+  # sandbox off the pack. The marker check needs no pack checkout, so it
+  # always runs; the drift check needs one and SKIPs (exit 93) without it.
+  if jq -e '._source | strings | contains("srt-policy-packs")' srt-settings.json >/dev/null 2>&1; then
+    ok "srt-settings.json declares its pack provenance"
+  else
+    fail "srt-settings.json lost its _source provenance marker"
+  fi
+  srt_sync_rc=0
+  srt_sync_out=$(./tools/sync-srt-policy.sh --check 2>&1) || srt_sync_rc=$?
+  if [ $srt_sync_rc -eq 0 ]; then
+    ok "srt-settings.json matches the generic-agent pack + overlay"
+  elif [ $srt_sync_rc -eq 93 ]; then
+    say SKIP "no srt-policy-packs checkout (set SRT_POLICY_PACKS to drift-check)"
+  else
+    printf '%s\n' "$srt_sync_out"
+    fail "srt-settings.json drifted from the pack (run tools/sync-srt-policy.sh)"
+  fi
 }
 
 # --- Build -----------------------------------------------------------------