test(ci): exact-line assert in grok-build config test (CodeQL #740/#741)

[diegosouzapw]

What

Replaces two URL-substring assertions in tests/integration/cli-settings-grok-build.test.ts (lines 146 & 203) with exact line membership.

Why

CodeQL js/incomplete-url-substring-sanitization (HIGH) flags content.includes("https://example.test/v1") as a URL-substring check. It's a false positive — the test asserts a TOML [model.custom-thing] section round-trips untouched through the grok-build config handler; there is no URL sanitization and example.test is a reserved test TLD.

But #740 + #741 are the only open CodeQL alerts repo-wide right now (they replaced #737 the moment it closed), and check:codeql-ratchet counts alerts repo-wide → they keep Quality Ratchet red on every open PR. This closes them at the source.

Fix

const preservedLines = content.split("\n").map((line) => line.trim());
assert.ok(
  preservedLines.includes("[model.custom-thing]") &&
    preservedLines.includes('base_url = "https://example.test/v1"'),
  "..."
);

Exact line membership is stronger than the old substring check — it verifies the URL sits on the base_url key, not merely somewhere in the file — and is no longer a substring-of-URL sink, so CodeQL stops flagging it. The handler preserves the section byte-for-byte, so exact match holds.

Validation (Hard Rule #18)

node --import tsx/esm --test tests/integration/cli-settings-grok-build.test.ts → 9 pass, 0 fail.

File exists only on release/v3.8.49 (added by #7241) — no main companion needed.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[diegosouzapw]

Verified — the two CodeQL alerts (#740/#741) map exactly to lines 146 and 203 in this file, and the exact-line assertion is strictly stronger than the old substring check (it pins the URL to the base_url key, not just "somewhere in the file"). Ran the suite locally: 9/9 pass. The two red checks are unrelated base-red (mutation-test-coverage flagging an unrelated Microsoft Designer test file, and the shared Unit Tests fast-path base-red). Merge-ready.