fix(lint): drain release-green hard failures on release/v3.8.50 (#9985)

[jonlwheat2-gif]

Drains the live release-green hard failures on release/v3.8.50 tracked in #9985 (see also #10296 — this is the gate blocking the v3.8.50 publish). Rebased on current tip ac02c5b42.

What was failing (RED)

npm run lint at tip ac02c5b42^ reported 22 net-new errors across 6 files; the release-green eslint step consequently died ("could not parse eslint json" — the report never came back clean, so the verdict never reached a passing state):

FirstRunReadinessCard.tsx        23:7   react-hooks/set-state-in-effect
EndpointPageClient.tsx           4:8    unused 'Link'
EndpointPageClient.tsx         141:10,28 unused expandedEndpoint / setExpandedEndpoint
EndpointPageClient.tsx      1135-1138  unused mcpOnline/a2aOnline/mcpToolCount/a2aActiveStreams
EndpointPageClient.tsx        1172:9  unused cloudflaredUrlNotice
EndpointPageClient.tsx        2501:10 unused component EndpointSection (134 dead lines)
CommandPalette.tsx             107:5   react-hooks/preserve-manual-memoization ×2
CommandPalette.tsx             159:5   exhaustive-deps missing 'activePreset'
cli-mcp-call-commands.test     35/135/200/235/286  unused makeCmd/url/url/url/init
cli-resilience-commands.test   2/19/34 unused makeMcpResp/captureStdout/makeCmd
cli-skills-commands.test       2:10    unused makeMcpResp

All of it is fallout from already-merged work (#11283 Traffic Inspector header refactor left dead code; the React-Compiler hooks rules newly enforced). No behavior regressions were involved on our side — verified by the full targeted test families below.

After (GREEN) — per-file changes

src/app/(dashboard)/dashboard/FirstRunReadinessCard.tsx
Before: dismissal read via useState(false) + useEffect that called setVisible(...) synchronously (:23-33).
After (lines 15-37): module-level external store (readinessListeners, subscribeReadiness, isReadinessDismissed) read through useSyncExternalStore (line 46) with server snapshot = dismissed (hydration-safe); dismiss is now a useCallback that writes storage and notifies listeners (48-56); render guard if (setupComplete || dismissed) (58). Net effect: zero setState-in-effect, no cascading renders, same UX including private-mode fallback.

src/app/(dashboard)/dashboard/endpoint/EndpointPageClient.tsx (dead code left by #11283)

• :4 Link import — removed
• :8-9 AI_PROVIDERS / getProviderByAlias / getProviderDisplayName imports — removed
• :141 expandedEndpoint state pair — removed
• :150-151 mcpStatus/a2aStatus bindings renamed _… (setters still drive refreshes)
• :1135-1138 four derived mcp/a2a values — removed
• :1172-1175 cloudflaredUrlNotice — removed
• :2501-2634 entire unused EndpointSection component — deleted (−134 lines)

src/shared/components/CommandPalette.tsx
:159 deps array [hiddenItems, radarAdminUrl, safeTranslate] → [hiddenItems, radarAdminUrl, safeTranslate, activePreset] — fixes exhaustive-deps and lets React Compiler preserve the memoization (both preserve-manual-memoization errors clear).

Tests (mechanical): cli-mcp-call-commands.test.ts — makeCmd helper removed (old :34-36), three (url, opts) fetch stubs → (_url, opts) (now :131/:196/:231), init → _init (:282). cli-resilience-commands.test.ts — import trimmed to makeMcpStreamFetch; unused captureStdout (:19-31) and makeCmd (:34-36) removed. cli-skills-commands.test.ts — import trimmed to makeMcpStreamFetch.

Verification matrix

Gate	Result
npm run lint (suppressions config, exact CI invocation)	0 errors (1 unrelated stale-directive warning in EditConnectionModal.tsx:297 — pre-existing drift on an untouched file, deliberately left)
Release-green eslint step reproduced verbatim (--format json --suppressions-location … --pass-on-unpruned-suppressions)	JSON parses; errors=0, warnings=1
npm run typecheck:core	clean
Targeted UI families (localization-contract, home-static, sidebar-essentials-static, source-scanner-guards, endpoint-list-models-10553, dashboard-shell-tabs)	33 pass / 0 fail — re-run green after each rebase
The 17-assertion unit cluster from the 08-23 audit	already green at tip (180/180 across the 12 named files) — nothing needed

Honest scope notes

• The intermittent gate-ceiling timeouts (unit/integration/package "hung gate") are runner-load/handle issues that do not reproduce from a branch checkout — not addressable here.
• Ratchet drift (chatBodyAdmission.ts file-size, bundle-size bytes) is explicitly non-blocking per the tracker policy ("rebaseline at release").
• Known follow-up kept out of scope: stale eslint-disable directive warning in EditConnectionModal.tsx:297 (untouched file; removing it could regress under different plugin versions).

Diff vs upstream/release/v3.8.50: 6 files changed, +45/−199.

---

dast-smoke: root cause found and fixed on this branch

Symptom (RED, every branch at this tip — including the maintainer's own #11309/#11310): 14 unique Schemathesis failures, all [500] Internal Server Error, spanning GET/POST/PATCH/DELETE/OPTIONS /api/keys*, /api/keys/{id}/devices, POST /api/auth/logout, and even the bare list call (curl -X GET …/api/keys) plus CORS preflights. Reproducers were trivial (id=0), proving it was not fuzz damage: the whole DB-backed management surface crashed at request time in the packaged boot.

Diagnosis: the workflow's uploaded server.log artifact contains the real stack, repeated per request:

Error: An error occurred while loading instrumentation hook:
[sqljsAdapter] Packaged sql.js runtime is incomplete: sql-wasm.wasm was not found. Checked:
  <dist>/node_modules/sql.js/dist/sql-wasm.wasm
  <dist>/.next/standalone/node_modules/sql.js/dist/sql-wasm.wasm

The build log shows the sql.js overlays did run ("Synced module: sql.js WASM fallback runtime"), immediately followed by Step 10.7 of scripts/build/prepublish.ts deleting them:

🧹 Pruning unexpected files from staged dist/...
✅ Removed dist/.build/next/node_modules/sql.js-<hash>/.devcontainer/Dockerfile
✅ Removed dist/.build/next/node_modules/@huggingface/transformers-<hash>/dist/…

Root cause: findUnexpectedArtifactPaths() enforces PACK_ARTIFACT_NEVER_ALLOWED_SEGMENTS = ["node_modules"] — an npm-tarball rule from the 79 MB devDependencies leak — which overrides the staging allowlist prefixes (.build/next/, node_modules/). The prepublish staging prune reuses that matcher, so it deleted the standalone server's runtime node_modules: Turbopack-hashed sql.js-* (including sql-wasm.wasm) and @huggingface/transformers-* (ort-wasm). Result: in every packaged boot the sqljs fallback adapter throws at instrumentation and every route touching SQLite returns 500 while /api/monitoring/health (DB-free) stays green — which is exactly why health-passing checks masked it.

Fix (commit 51bad4135): findUnexpectedArtifactPaths() gains a neverAllowedSegments option. The publish gate keeps the strict default (the tarball guard is intact — pinned by a new default-mode test), while the staging prune passes neverAllowedSegments: [] because its allowlist prefixes are the runtime contract.

Validation:

• RED→GREEN: new cases in tests/unit/pack-artifact-policy.test.ts fail on the old matcher (staged wasm path flagged) and pass after; the tarball-guard test still asserts node_modules stays rejected in pack mode.
• Live validation: dast-smoke went from ❌ 14 failures to ✅ SUCCESS on this PR's CI after the fix landed.

[jonlwheat2-gif]

The prepublish Step 10.7 prune reused the npm-tarball rule
(PACK_ARTIFACT_NEVER_ALLOWED_SEGMENTS = ['node_modules']), which overrides
the staging allowlist. That deleted the standalone server's runtime deps —
Turbopack-hashed sql.js (dist/sql-wasm.wasm!) and
@huggingface/transformers ort-wasm — so packaged boots (dast-smoke,
omniroute CLI) threw at instrumentation: '[sqljsAdapter] Packaged sql.js
runtime is incomplete' and every DB-backed management route (/api/keys*,
/api/auth/logout) returned 500 while /api/monitoring/health stayed green.

findUnexpectedArtifactPaths gains a neverAllowedSegments option; the
publish gate keeps the strict default, and the staging prune passes []
because its allowlist prefixes (.build/next/, node_modules/) are the
runtime contract. RED→GREEN covered by pack-artifact-policy tests;
live validation via dast-smoke on PR #11317." 2>&1 | tail -1 && git push origin fix/release-v3.8.50-basereds 2>&1 | tail -1
3 files changed, 61 insertions(+), 2 deletions(-)
38514ff..51bad41 fix/release-v3.8.50-basereds -> fix/release-v3.8.50-basereds