First script of slice 11. Mechanical DV-2.0 frontmatter backfill
for SKILL.md files. Computes 5 missing fields from git history
(record_source / load_datetime / last_updated / status /
bp_rules_cited) and injects before closing frontmatter fence.

Byte-equivalent against bash original on --dry-run mode.

Mechanical changes:
- bash awk frontmatter parse → fieldPresent + dashCount helpers
- bash compute_record_source heuristic (round-N regex + author-
  date fallback) preserved as computeRecordSource
- bash mktemp + awk inject + mv rename → readFileSync +
  injectBeforeSecondFence + writeFileSync
- bash 'INJECT_BLOB env-passing' awk pattern → in-memory string
  array
- bash --all glob (find -maxdepth 2) → readdirSync filter
- All output strings preserved verbatim

Lint-clean (eslint + sonarjs + tsc).

CodeQL flagged 2 file-system-race-condition findings on
backfill_dv2_frontmatter.ts where stat-then-read patterns
(statSync(path).isFile() followed by later readFileSync) could
race. Refactored to:

1. processOne: removed initial statSync gate; readFileSync
   directly with try/catch + ENOENT/EISDIR detection on the
   error.code property to map to warn/error outcomes. Preserves
   the original bash 'skip non-file' UX without the race window.
2. findAllSkillFiles: removed statSync probe of candidate paths;
   readdirSync only filters by directory entries; processOne
   handles missing/non-file paths gracefully via its try/catch.

Equivalence preserved: --dry-run output unchanged on a fresh
SKILL.md fixture.

Lint-clean (eslint + sonarjs + tsc).

Codex flagged backfill_dv2_frontmatter.ts losing the bash
original's atomic-rewrite invariant: bash used `mktemp` + `mv`
so a crash/kill/disk-full mid-write leaves the source file
intact. The TS port's writeFileSync truncates in place — a
real regression vs bash.

Restored: write to sibling tmp file (`<path>.tmp.<pid>.<ts>`)
then renameSync to target. Same-filesystem rename is atomic
on POSIX. Cleanup on failure: unlink the tmp + return structured
error outcome (exitCode 2).

…ex P2

Codex flagged that the audit-packages.ts repoRoot using
`git rev-parse --show-toplevel` with cwd fallback regresses
invocation semantics from the bash original
(`cd "$(dirname "$0")/.." && pwd`). Bash resolves the script
location and walks up; TS+git-rev-parse fails outside a git
checkout (falls back to wrong cwd).

Fixed: switch to `fileURLToPath(import.meta.url)` + `resolve`
to match bash's script-relative resolution. Now works from any
caller directory and outside git checkouts.

Codex flagged renameSync(tmpPath, file) as a potential Windows
data-loss issue (older Node fs.rename refused to overwrite on
Windows). Modern Node/Bun renameSync DOES overwrite atomically
on all platforms, but edge cases (Windows file locks from open
editors, permission-restricted network shares) can still fail.

Added defense-in-depth fallback: catch the renameSync failure,
unlink the destination, then retry rename. Loses atomicity for
the failure window but recovers correctness. Bash 'mv' has the
same fragility — same UX as bash, just more robust.

…per Codex P1+P2

P1 backfill_dv2_frontmatter (preserve-original-on-failure):
Removed the unlink-before-retry fallback that risked deleting the
original SKILL.md without successfully writing the new content.
On rename failure, return error with tmp-preserved message; do
NOT touch the original. Modern Node/Bun renameSync handles the
common case atomically; rare failures (Windows file lock, perms,
disk-full) leave the original intact + tmp recoverable.

P2 audit-packages (fail-on-empty-parse):
If PACKAGE_RE.exec yields 0 entries on a non-empty
Directory.Packages.props, the regex has likely drifted from the
file format. Silent success hides this. Now returns exit 1 with
clear error pointing at the regex-drift suspicion.

Headline said '33 hygiene/lint/audit scripts ported' but the
parenthesized addends summed to 32 (including the 2 in-flight).
Two issues conflated:

1. 'ported' implies merged but the count included in-flight.
2. Off-by-one — 11 merged-PR contributions sum to 30, not 31.

Fixed: '30 ported + 2 in-flight = 32 total' with explicit
delineation between merged and in-flight.