fix(repo): untrack node_modules symlink, guard against tracked symlinks (#3463)

Commit faf5cdba tracked `node_modules -> /tmp/fleet/repo/node_modules`.
That path exists only on the sandbox that produced it, so every other
clone materialized a dangling symlink and `bun install` aborted with
`ENOENT: could not open the "node_modules" directory`. That also broke
`gbrain upgrade` on bun-link installs, which shells out to bun install
and then prints a manual fallback that fails identically.

Three changes:

- Untrack the symlink (`git rm --cached node_modules`).
- Drop the trailing slash from the .gitignore node_modules patterns. A
  `node_modules/` pattern matches directories only, which is why a
  symlink of the same name was never ignored in the first place.
- Add scripts/check-no-tracked-symlinks.sh, wired into `bun run verify`
  and `check:all`. The .gitignore fix alone is not sufficient, since
  `git add -f` bypasses it; the guard fails on any mode-120000 entry.
  The repo has no legitimate tracked symlinks, so it starts with an
  empty allowlist.

Covered by test/no-tracked-symlinks-guard.test.ts, which builds a
throwaway repo containing the exact symlink shape and asserts the guard
exits 1 and names the offender.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/check-no-tracked-symlinks.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# CI guard: fail if any symlink is tracked in git.
+#
+# A symlink committed from a build sandbox points at a path that exists on
+# exactly one machine. Everywhere else the checkout produces a dangling
+# link, and anything that opens it fails. That is not hypothetical: commit
+# faf5cdba landed `node_modules -> /tmp/fleet/repo/node_modules`, which made
+# `bun install` abort with `ENOENT: could not open the "node_modules"
+# directory` on every fresh clone, and took `gbrain upgrade`'s bun-link path
+# down with it (the auto-upgrade runs `bun install`, so the printed manual
+# fallback failed the same way).
+#
+# .gitignore alone does not prevent this. A `node_modules/` pattern with a
+# trailing slash matches directories ONLY, so a symlink of the same name is
+# never ignored. Dropping the slash closes that hole, but `git add -f` still
+# walks straight past it. This guard is the backstop.
+#
+# The repo has no legitimate tracked symlinks, so the allowlist starts
+# empty. If you ever need one, add its exact repo-relative path to ALLOWLIST
+# below and explain why — a relative link that resolves inside the repo is
+# defensible; an absolute one almost never is.
+#
+# Usage: scripts/check-no-tracked-symlinks.sh
+# Exit:  0 when clean, 1 when a tracked symlink is found.
+
+set -euo pipefail
+
+ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+cd "$ROOT"
+
+# Paths permitted to be tracked symlinks. Empty by design.
+ALLOWLIST=()
+
+# Git records symlinks with mode 120000. Field 4 of `ls-files -s` is the path
+# (tab-separated from the stage number), so cut on the tab to keep paths with
+# spaces intact.
+found="$(git ls-files -s | awk '$1 == "120000"' | cut -f2- || true)"
+
+if [ -n "$found" ]; then
+  filtered="$found"
+  for f in "${ALLOWLIST[@]:-}"; do
+    [ -z "$f" ] && continue
+    filtered="$(echo "$filtered" | grep -vxF "$f" || true)"
+  done
+
+  if [ -n "$filtered" ]; then
+    echo "ERROR: symlink(s) tracked in git:"
+    echo
+    while IFS= read -r path; do
+      [ -z "$path" ] && continue
+      target="$(git cat-file blob ":$path" 2>/dev/null || echo '<unreadable>')"
+      echo "  $path -> $target"
+    done <<< "$filtered"
+    echo
+    echo "A committed symlink resolves on the machine that created it and"
+    echo "nowhere else. Untrack it:"
+    echo
+    echo "  git rm --cached <path>"
+    echo
+    echo "If the path is build output (node_modules, dist, bin), also confirm"
+    echo "it is covered by .gitignore WITHOUT a trailing slash — a trailing"
+    echo "slash matches directories only and lets the symlink through."
+    exit 1
+  fi
+fi
+
+echo "check-no-tracked-symlinks: OK (no tracked symlinks)"

scripts/run-verify-parallel.sh

@@ -42,6 +42,7 @@ CHECKS=(
   "check:source-id-projection"
   "check:source-config-leak"
   "check:progress"
+  "check:no-tracked-symlinks"
   "check:test-isolation"
   "check:wasm"
   "check:admin-build"