chore: combined audit follow-ups (lefthook mirror, stale-ID strip, fixture comments, gremlins policy)

[tsouza]

Summary

Combined chore PR for 4 small items from the 2026-05-22 coverage-gaps review.

1. Lefthook mirror of scripts/check-skip-additions.sh (Gap 4) — adds a forbid-should-skip-additions step to pre-push so the local hook catches net-new should_skip: entries without a tracking ref before CI does. Mirrors the CI forbid-skip job's Guard new should_skip entries step. +13 LOC in lefthook.yml.
2. Strip stale roadmap-ID refs (Gap 3) — drops R6.11a from internal/chsql/builder_test.go, RC1-relevant from internal/optimizer/property_test.go, and RC1 baseline / M1.x ticket from compatibility/prometheus/cerberus-test-queries.yml. Also marks the 4 upstream-carryover prom-yml TODOs with explicit TODO(upstream): prefixes so the boundary between cerberus-actionable TODOs and upstream's own corpus notes is clear. RC2 + RC3 references in CHANGELOG.md / docs/forbid-skip.md / scripts/test-forbid-skip.sh are intentionally kept (they're either shipped releases or load-bearing regex examples).
3. Document why 5 empty-result fixtures expect no rows (Gap 2) — adds top-of-file justification comments to 5 fixtures whose -- expected_rows -- block is [] and had no explanatory header anywhere: traceql/count.txtar, traceql/count_eq_zero.txtar, traceql/structural_descendant_of_intersect.txtar, promql/binop_vv_on_compare_lt.txtar, logql/binop_vv_compare_filter.txtar. The other empty fixtures in the audit list already carry header comments.
4. Codify gremlins surviving-mutant policy (Gap 1) — adds a Surviving-mutant policy subsection to docs/test-strategy.md § Gremlins mutation. Prefers (1) prove-equivalent + drop the phase threshold by 1pp over (2) add a distinguishing test over (3) refactor production code to defeat the mutant. PRs refactor(qlcommon): make label_replace loop-control observably distinguishable #504 / test(logql): kill gremlins phase4-logql survivors from #663 #664 carry pattern chore(deps): Bump actions/setup-go from 5 to 6 #3 refactors and are called out explicitly so future contributors don't repeat the pattern.

Rec #14 from the dirty-fix audit (verify all _comment / tracking-ref escape hatches cite a tracking issue) was checked separately — moot, no changes: prom + tempo expected-failures.json both have empty failures arrays; the loki overlay's 22 should_skip: entries all already cite docs/loki-compliance-plan.md PR 6 in their jira: field. Task brief flagged this would likely be moot post-#712; verified true today against current main.

Note on #1 in light of open PR #712 (which deletes scripts/check-skip-additions.sh wholesale): if #712 merges first, this PR's lefthook step will fail-loud on the next push (missing script). Whichever PR merges second should drop the corresponding side — the diffs are tiny and orthogonal otherwise.

Test plan

• CI lint + check + forbid-skip + compatibility/{prometheus,loki,tempo} + compose-smoke all green.
• LEFTHOOK=0 was used locally for commits; the new lefthook step itself is exercised by CI's existing Guard new should_skip entries job + lefthook self-test from any future contributor who installs the hooks.
• No new fixtures broken — the comments-only changes go into the txtar archive's preamble (parsed into txtar.Archive.Comment, ignored by the test runner).

🤖 Generated with Claude Code