chore(ci): re-admit policy docs into ci-cache-hash before doc relocation

docs/**/*.md is deny-listed from the CI cache hash (test-irrelevant). The
CLAUDE.md restructure moves test/release POLICY into docs/TESTING.md +
docs/RELEASING.md, which DO carry contracts the test suite reads. Without
re-admitting them, a policy-only edit would produce the same cache hash and
skip the test shard that runs the build-llms + doc-history guards (false-pass).

Adds an ALLOW_PATTERNS re-admit step after the deny, scoped to the named
policy docs (not a blanket docs un-deny). Lands FIRST, before any doc moves.

Pinned by 3 new cases in test/scripts/ci-cache-hash.test.ts: TESTING.md +
RELEASING.md edits MUST change the hash; docs/guide.md still must not.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

test/scripts/ci-cache-hash.test.ts

@@ -400,6 +400,50 @@ describe("ci-cache-hash.sh — edge cases", () => {
   });
 });
 
+describe("ci-cache-hash.sh — policy-doc re-admit (test-affecting docs under docs/)", () => {
+  // These docs live under docs/ (normally deny-listed) but carry CI/release/
+  // test contracts the suite reads. The re-admit must make edits to them
+  // invalidate the hash, WITHOUT un-denying ordinary docs.
+  const POLICY_FILES: Record<string, string> = {
+    ...BASELINE_FILES,
+    "docs/TESTING.md": "# Testing\n\ntest tiers + isolation lint\n",
+    "docs/RELEASING.md": "# Releasing\n\nversion locations + ship process\n",
+  };
+
+  function withSandbox(test: (sb: Sandbox) => void) {
+    const sb = makeSandbox(POLICY_FILES);
+    try {
+      test(sb);
+    } finally {
+      rmSync(sb.dir, { recursive: true, force: true });
+    }
+  }
+
+  it("docs/TESTING.md edit MUST change hash (re-admitted policy doc)", () => {
+    withSandbox((sb) => {
+      const before = hash(sb);
+      modify(sb, "docs/TESTING.md", "# Testing\n\nNEW POLICY\n");
+      expect(hash(sb)).not.toBe(before);
+    });
+  });
+
+  it("docs/RELEASING.md edit MUST change hash (re-admitted policy doc)", () => {
+    withSandbox((sb) => {
+      const before = hash(sb);
+      modify(sb, "docs/RELEASING.md", "# Releasing\n\nNEW SHIP RULE\n");
+      expect(hash(sb)).not.toBe(before);
+    });
+  });
+
+  it("docs/guide.md edit STILL produces same hash (re-admit is scoped, not a blanket docs un-deny)", () => {
+    withSandbox((sb) => {
+      const before = hash(sb);
+      modify(sb, "docs/guide.md", "# Guide v3\n");
+      expect(hash(sb)).toBe(before);
+    });
+  });
+});
+
 describe("ci-cache-hash.sh — usage errors", () => {
   it("--bogus arg exits 2", () => {
     const r = spawnSync("bash", [SCRIPT_SRC, "--bogus"], {