feat(contract): add fixture cases for colon paths and empty scope-path segment (#358)

Three gaps exposed by the Phase 2 divergence runs (cloud#2738):
- colon-in-scope-path cases pin SplitN(scope, ":", 4) semantics — hosted
  TS's String.split(":", 4) truncates the remainder, turning /a:b/** into
  the exact path /a (wrong-allow and wrong-deny potential).
- empty-fourth-segment case pins that relayfile:fs:read: (trailing colon)
  is a narrow grant matching nothing — hosted TS maps it to "*" and grants
  the whole namespace.
- colon-in-segment-valid pins colons as ordinary path bytes in the
  scope-path grammar with the expected mounts_at.

All cases pass against unmodified Go enforcement (behavior pinned, not
changed). Additive v1 fixtures; no version bump.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: khaliqgant

contract/fixtures/auth-matching.json

@@ -255,6 +255,30 @@
       "file": "/github/x",
       "expect": { "auth_matches": true }
     },
+    {
+      "name": "colon-in-scope-path-is-preserved",
+      "description": "Scope splitting is SplitN(scope, \":\", 4): the path segment keeps any further colons (§4). Pins the truncating-split divergence found in hosted TS (String.split with a limit drops the remainder).",
+      "scopes": ["relayfile:fs:read:/a:b/**"],
+      "required": "fs:read",
+      "file": "/a:b/x.json",
+      "expect": { "auth_matches": true }
+    },
+    {
+      "name": "colon-in-scope-path-does-not-truncate-to-prefix",
+      "description": "A truncating split turns /a:b/** into the exact path /a; this case fails such an implementation.",
+      "scopes": ["relayfile:fs:read:/a:b/**"],
+      "required": "fs:read",
+      "file": "/a",
+      "expect": { "auth_matches": false }
+    },
+    {
+      "name": "empty-fourth-segment-is-a-narrow-grant-matching-nothing",
+      "description": "relayfile:fs:read: (trailing colon, empty scope path) is an invalid narrow grant: it matches no file and, being narrow, still suppresses nothing-else semantics — it must NOT be read as the 3-segment full-namespace form. Pins the hosted-TS empty-path-becomes-* divergence.",
+      "scopes": ["relayfile:fs:read:"],
+      "required": "fs:read",
+      "file": "/src/app.ts",
+      "expect": { "auth_matches": false }
+    },
     {
       "name": "two-segment-scope-is-opaque-literal-not-grant",
       "description": "Scopes with <3 segments never act as path grants; they only match as exact literals of the requirement string.",

contract/fixtures/scope-paths.json

@@ -18,6 +18,12 @@
     { "name": "deep-recursive-glob-valid", "scope_path": "/slack/channels/c123/messages/**", "expect": { "valid": true, "mounts_at": "/slack/channels/c123/messages" } },
     { "name": "prefix-glob-valid", "scope_path": "/github/repos/acme-*", "expect": { "valid": true, "mounts_at": "/github/repos" } },
     { "name": "top-level-prefix-glob-mounts-at-root", "scope_path": "/github*", "expect": { "valid": true, "mounts_at": "/" } },
+    {
+      "name": "colon-in-segment-valid",
+      "scope_path": "/a:b/**",
+      "description": "Colons are ordinary path bytes; only the first three colons of the scope string delimit segments (§4).",
+      "expect": { "valid": true, "mounts_at": "/a:b" }
+    },
     {
       "name": "mid-path-segment-globs-invalid",
       "scope_path": "/github/repos/*/*/issues/**",