fix(scripts): close gates that passed while the thing they guard was disabled

Four repo gates reported success in states they exist to reject.

`check-vale-style-sync.sh` passed while a Kyberforge lint rule was silenced. The
check matched a blocklist of severity values, but Vale's semantic is an allowlist:
anything that is not exactly YES/error/warning/suggestion disables the rule. So
`= false`, `= 0`, `= garbage`, an empty value and — worst — a lowercase `= yes` all
killed enforcement while reading as "enabled" to a human. Inverted to an allowlist.
Two sibling holes: dropping `KyberforgeCopilot` from `BasedOnStyles` unloaded the
Copilot-only check silently, and narrowing a section glob to a location made Vale
lint zero files, which is the "0 files, hook Passed" failure the script's own
comment says it exists to catch.

`sync-marketplace-mirror.sh --check` failed open when its source was missing, while
its sibling correctly errored in the same state.

`check-scope-walkup-sync.sh` wrote to hardcoded `/tmp/fN.out` paths and read one
back, making it non-reentrant — a concurrent instance can flip a verdict, and this
branch made the test runner concurrent. Now per-run `mktemp -d`.

`check-manifests.sh` had no disk-to-marketplace pass, so a plugin directory absent
from `marketplace.json` passed every gate while the `validate-plugins` hook globbed
it. The "listed" match is restricted to remote-source entry names; matching any
entry name let a genuine orphan through on a name coincidence.

`run-bats.sh` reported an empty TAP stream as `0 tests, 0 failures`, exit 0 — a
total harness failure reading as a pass.

The test-side changes are the larger half, because the guards were the real problem.
`test-sync-marketplace-mirror.sh` could overwrite the live tracked mirror under an
inherited GIT_DIR, which is precisely the git-hook context it runs in. The bash-3.2
scan hand-maintained its file list, omitting the new shared runner, and had no rule
for `wait -n` or `nproc` — the two hazards the previous review round found live. It
now derives 43 files across three globs with per-glob floors. Several assertions
were decoration: the concurrency checks caught the reentrancy defect 0 times in 10,
the leak fix was green either way, and two manifest fixtures passed with the code
they claimed to cover deleted. Every assertion now has a revert it provably fails
against.

Refs: #90

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT

tests/run-bats.sh

@@ -66,6 +66,7 @@ batch_run "$SCRATCH_ROOT" ${batch_args[@]+"${batch_args[@]}"}
 FAIL=0
 TOTAL_OK=0
 TOTAL_NOT_OK=0
+TOTAL_PLANS=0
 i=0
 for f in ${TEST_FILES[@]+"${TEST_FILES[@]}"}; do
     i=$((i + 1))
@@ -75,13 +76,38 @@ for f in ${TEST_FILES[@]+"${TEST_FILES[@]}"}; do
     echo ""
     file_ok="$(grep -c '^ok ' "$SCRATCH_ROOT/$i.log" || true)"
     file_not_ok="$(grep -c '^not ok ' "$SCRATCH_ROOT/$i.log" || true)"
+    # The TAP plan line (`1..N`). Counted separately from the results because an
+    # empty-but-valid file emits `1..0` and no result lines at all -- that is a
+    # file bats really did run, so it has to be distinguishable from a file that
+    # produced nothing whatsoever.
+    file_plan="$(grep -c '^1\.\.[0-9]' "$SCRATCH_ROOT/$i.log" || true)"
     status="$(cat "$SCRATCH_ROOT/$i.status" 2>/dev/null || echo 1)"
     TOTAL_OK=$((TOTAL_OK + file_ok))
     TOTAL_NOT_OK=$((TOTAL_NOT_OK + file_not_ok))
+    TOTAL_PLANS=$((TOTAL_PLANS + file_plan))
     if [[ "$file_not_ok" -gt 0 || "$status" -ne 0 ]]; then
         FAIL=1
     fi
 done
 
+# Zero counted tests is never a clean run: files were found (the empty-TEST_FILES
+# case exits above), so nothing was executed. Without this, a `bats` that emits
+# nothing and exits 0 -- a broken binary, a formatter change, or a wholesale
+# `@test` removal -- reports "0 tests, 0 failures" and exits green, silently
+# turning a total harness failure into a pass.
+#
+# The two causes get different messages because they are different problems and
+# `1..0` is itself valid TAP: no plan lines at all means bats produced no output
+# to parse, while plans present with zero results means bats ran fine and the
+# files genuinely declare no tests.
+if [[ $((TOTAL_OK + TOTAL_NOT_OK)) -eq 0 ]]; then
+    if [[ "$TOTAL_PLANS" -eq 0 ]]; then
+        echo "Error: ${#TEST_FILES[@]} .bats file(s) ran but produced no TAP output at all — the bats harness is broken" >&2
+    else
+        echo "Error: ${#TEST_FILES[@]} .bats file(s) declared 0 tests — every @test appears to have been removed" >&2
+    fi
+    FAIL=1
+fi
+
 echo "$((TOTAL_OK + TOTAL_NOT_OK)) tests, $TOTAL_NOT_OK failures"
 exit "$FAIL"