[quality] test: cover data/milestones.json contract and MILESTONES.md parity (tests/milestones-data.test.mjs)

[kubestellar-hive]

Test Improvement

Adds one new test-only file, tests/milestones-data.test.mjs (13 tests). No
production code, no workflow, no data and no dependency is touched.

Files claimed by this PR: tests/milestones-data.test.mjs only.

data/milestones.json landed on 2026-09-16 in 00b44df (#183) with two consumers
and no test: .github/workflows/create-milestones.yml drives gh api from it
via jq, and MILESTONES.md restates the same plan in prose. This PR asserts
both contracts against the committed data.

Workflow contract (.github/workflows/create-milestones.yml)

• top level is an object with a non-empty milestones array
• every title is a non-blank string with no tab or newline — the workflow
  resolves existing milestones with awk -F '\t' -v title=..., so a tab would
  split the lookup key and create a duplicate milestone instead of reusing one
• titles are unique
• every description is a non-blank string — jq -r '.description' prints the
  string null for a missing key, which the workflow would post as the
  description
• every milestone has an issues array of positive safe integers — a missing
  key makes jq -r '.issues[]' fail under the step's set -euo pipefail,
  aborting the run after earlier milestones were already created
• no issue number appears under two milestones, and none repeats within one —
  GitHub allows one milestone per issue, so a second assignment silently
  overwrites the first

Doc/data parity (MILESTONES.md)

parseMilestonesDoc reads the ## Milestone: <title> headings, unwraps each
**Description**: paragraph, and collects #<n> references (expanding
#41–#43 ranges) from the bullet list introduced by a Tag ... line. Issue
collection is deliberately scoped to that bullet list: the KubeCon section's
prose mentions #74–#80, which belong to Phase 1, and a document-wide scan would
misattribute them. Titles, order, descriptions and issue assignments are then
compared with the JSON. The parser has its own three unit tests against inline
fixtures, so the parity assertions cannot pass by parsing nothing.

Verification

node --test after npm ci: 68 tests pass, 0 fail (55 before).
npx prettier --check tests/milestones-data.test.mjs is clean.

Mutation-checked — the assertions were confirmed to fail, not just pass:
injecting a cross-milestone duplicate issue, a blank description, a deleted
issues array, and separately a renamed MILESTONES.md heading each turned the
corresponding tests red; the working tree was restored afterwards and
git status is clean apart from the new test file.

Deliberately not covered

.github/workflows/create-milestones.yml itself — its shell/gh logic is not
exercised here, only the data contract it depends on. That is unchanged by this
PR and is out of scope; this agent cannot push workflow files in any case.

Related Issue

Refs #234

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5

[kubestellar-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.