fix(scripts): three comments and one guard that cite mechanisms not on main

[atbrace]

Refs gcy-ajv. Completes the sweep that PRs #1 (gcy-edv) and #3 (gcy-2o1) each fixed one instance of.

The pattern

A comment asserts a protection or a canonical source that is not present, and that comment is the stated reason the code does what it does. It isn't merely stale — it's load-bearing, because a reader uses it to conclude an omission is intentional and covered.

Method

Mechanical and reproducible: extract every path cited in .githooks/, scripts/, and the Makefile (104 distinct), then git cat-file -e origin/main:<path> each one. Branch-locality is the trap — checking the working tree finds nothing, because the repo root sits on a deploy branch. Three real hits after discarding Go import paths, symbol references, and test fixtures.

1. scripts/check-core-boundary.sh — a guard that silently checks nothing

COMMERCIAL_SURFACE lists internal/serviceproto, which does not exist on main, and the loop did [ -e "$p" ] || continue. Check (f) therefore scanned two of its three surface members and the script still printed OK (no commercial coupling in the OSS module).

That contradicts the file's own contract, stated ~100 lines above in its header:

FAILS CLOSED: if a check cannot evaluate (e.g. go.mod is unreadable), that is a violation, not a pass. A guard that silently passes when it cannot evaluate manufactures false confidence.

This is latent, not an active hole. The absence is legitimate today — serviceproto is planned for this module, not the hosted one (engdocs/plans/hosted-onboarding/DESIGN.md:154), so check (f) is wired ahead of its package exactly as check (e) is wired ahead of OpenFeature. The difference is that (e)'s inertness is documented and (f)'s was not.

So the skip now announces itself via note() rather than becoming fatal. Behaviour and exit status are unchanged — this runs in CI at .github/workflows/ci.yml:189 — but the guard can no longer stay silently switched off once serviceproto lands, or if a path here is ever misspelled.

$ bash scripts/check-core-boundary.sh
check-core-boundary: (f) surface member not present, not scanned: internal/serviceproto
check-core-boundary: OK (no commercial coupling in the OSS module)
exit=0

2. scripts/gc-session-docker:45 — a canonical copy that isn't there

"Matches the K8s provider's skip list in internal/session/k8s/pod.go buildPodEnv()."

No internal/session/k8s exists on main, and the one sibling that does exist — contrib/session-scripts/gc-session-k8s — carries no equivalent list. The claim is load-bearing: it is the stated reason the del(...) list has the contents it has, telling a maintainer their edit must match a canonical copy that does not exist. Replaced with what is true — the list is maintained here and derived from nothing else.

3. scripts/gc-session-docker:8 — wrong pointer

Pointed at internal/session/exec/exec.go for the exec provider protocol; that file does not exist. The protocol is documented in docs/reference/exec-session-provider.md, which does.

Checked, deliberately not changed

scripts/lib/common.sh, scripts/lib/test-slice.sh (cited relatively, both present); install-bd-archive.sh / install-dolt-archive.sh / mol-dog-backup.sh (cited with .github/ and examples/ prefixes the extraction stripped — all present, and guarded by their own pin tests); internal/example (a test-fixture package name, not a path).

bash -n clean on both files. No .go, web, or docs paths staged, so pre-commit is a no-op.