Scanner counts test fixtures / compiled-test output as production endpoints → inflated cost

[AndresL230]

Summary

The workspace/CLI scanner counts test fixtures, compiled test output, and other non-production files as real production API endpoints. This dominates the cost estimate — e.g. scanning this repo itself reports $5,346.94/mo, of which $5,310 comes from three Stripe endpoints that only exist in dist-test/**/*.test.js test fixtures.

Evidence

Local scan of recost/extension (its own source):

• 45 endpoints detected; 40 of them appear only in test-like files (dist-test/...test.js, src/test/...).
• Dropping test-only endpoints takes the total from $5,346.94 → $0.02 (the 5 survivors are the extension's actual external calls).
• sapling: 74 of 224 endpoints are test-only noise.

Root cause

The intent to skip test files already exists but is incomplete and duplicated:

1. file-discovery.ts:DEFAULT_IGNORE_PATTERNS only ignores **/*.test.ts / .tsx / .spec.ts / .tsx — so compiled *.test.js / *.spec.js slip through.
2. file-discovery.ts:HARD_EXCLUDED_SEGMENTS is missing dist-test and dashboard-dist. (A second, drifted copy in src/scanner/path-excludes.ts does list them, but that copy is imported only by a test — production scanning uses the file-discovery copy.)
3. src/test/ directories aren't excluded. src/intelligence/file-signals.ts:isTestLikeFilePath() already encodes the canonical test-path logic (src/test/, __tests__/, .test., .spec.) but it's used only to deprioritize in the intelligence layer, never to exclude at scan time.

Proposed fix

1. Broaden DEFAULT_IGNORE_PATTERNS test globs to all extensions: **/*.test.*, **/*.spec.*, **/__tests__/**, **/test/**, **/tests/**.
2. Add dist-test and dashboard-dist to file-discovery's HARD_EXCLUDED_SEGMENTS.
3. Reconcile the duplicate: delete src/scanner/path-excludes.ts and repoint src/test/workspace-scanner.test.ts at the file-discovery exports — one source of truth.
4. Leave the opt-in recost-mock-calls.* fixture behavior untouched.

Acceptance criteria

• A scan of recost/extension reports no endpoints sourced solely from dist-test/, src/test/, or *.test.* / *.spec.* files.
• dist-test/ and dashboard-dist/ are never scanned.
• Single source of truth for hard-excluded segments (no path-excludes.ts duplicate).
• Unit tests: *.test.js, dist-test/x.js, src/test/x.ts are excluded; a normal src/services/x.ts is not (and a file like latest.ts or dir contest/ is not falsely excluded).

Context

Found while validating the #45 CLI remote path. Pairs with the calibration issue (filed separately) and the CLI provider bug #136. The two together take recost/extension from a fabricated $5,346.94/mo to a defensible $0.02/mo in a dry-run.