test(facts-eval): reconcile the harness to the exact-by-name contract

[basicScandal]

What & why

The facts matcher is unchanged by this PR. resolvePackage has been exact-by-name (normalized lowercase+trim) since 7f15673, which deliberately closed a fabrication class — fuzzy/token matching returned a different package's facts as authoritative ("express rate limit" → express, @starloghq/facts-schema → q). That commit scoped harness reconciliation out; a later refactor rewired lookupFacts onto the exact path, silently changing what the scorer measured, and the baseline was never updated. So bench:facts had been reporting a phantom regression (recall 0.52 vs a 0.84 baseline left over from the retired substring matcher).

This reconciles the eval harness to the contract the matcher actually implements — no matcher change.

Changes

• Split the old fuzzy-positive kind. The 5 case/whitespace variants that reduce to an exact key (lowercase+trim — the only tolerance the by-name path offers) → true-positive. The 15 NL/fuzzy/surface-form queries → a new search-scope kind (expected: null — silence is correct; resolution is starlog_search's job). Each names its intended package in the rationale, so nothing is hidden.
• search-scope is scored in its own bucket and EXCLUDED from hit_recall / positive_precision / hard_negative_fp_rate. A new fabrication-regression gate fails the bench if the by-name path ever starts resolving one of them.
• Fixed stale negative labels the corpus outgrew. axios/express/request-promise were added to L2, so their negative cases were factually broken (the bench flagged them as FPs). Swapped in genuinely out-of-corpus packages (react, webpack) and an equivalent substring trap (express-session), preserving the negative-set size. Re-kinded three NL queries about now-in-corpus packages (lodash, moment vs date-fns, moment or date-fns) → search-scope.
• Re-baselined to the reconciled numbers.

On "100% recall"

This is a near-tautology of deterministic exact matching on exact-name inputs — not an achievement, and not "recall improved." The harness's real teeth now live in the negative (35 hard-negative + 7 out-of-corpus) and fabrication (18 search-scope) buckets.

What would this harness now fail on? Exactly three real regressions:

1. a bare corpus name stops resolving,
2. a hard-negative / out-of-corpus trap starts resolving (false positive),
3. a search-scope query starts resolving (fabrication — the class 7f15673 closed).

Scorecard (reconciled)

hit_recall            : 100.0%
positive_precision    : 100.0%
hard_negative_fp_rate :   0.0%
search-scope (excluded): 18/18 correctly silent
per-kind: true-positive 16, hard-negative 35, out-of-corpus 7, robustness 29, search-scope 18  (=105)

Verification

Full suite green (606 passed), typecheck clean, npm run bench:facts PASS against the new baseline.

🤖 Generated with Claude Code