fix: properly fix the 3 infrastructure issues E2E testing surfaced

Cycle 8 was a band-aid fix layer; this is the proper one.

1. **`.github/meta/commit.txt` now untracked + gitignored**
   - Per CLAUDE.md, this file is a *transient* commit-message scratch.
   - Tracking it produced false-positive branding leaks (it quotes
     upstream brand strings while describing rebrand fixes).
   - Untracked from git, added pattern to .gitignore so future commits
     don't accidentally re-add it. Pattern also covers diff.txt and
     pr-body-*.md transient templates.
   - Kept `.github/meta/**` in script/upstream keepOurs as defense-in-
     depth (in case anyone tracks one again).

2. **CI now installs script/upstream/ deps in the TypeScript job**
   - script/upstream/ is its own bun workspace (depends on minimatch).
   - Root `bun install` doesn't reach it.
   - The bridge-merge-e2e.test.ts spawns `analyze.ts --branding` which
     needs minimatch — failed in CI with `Cannot find package
     'minimatch'` despite passing locally.
   - Added an explicit "Install merge tooling deps (script/upstream)"
     step to the TypeScript job, mirroring the marker-guard job's
     existing step.
   - The E2E test still has a `ensureScriptDeps()` belt-and-suspenders
     auto-installer for offline/local runs.

3. **altimate-engine reverted** — kept in keepOurs.
   - Initial diagnosis (commit 845ee98 deleted the package) was
     wrong. The keepOurs glob is required by both
     `upstream-merge-guard.test.ts` config-integrity test and the
     README's Fork Strategy section.
   - Reverted both removals in this commit.

Verification
- `bun test packages/opencode/test/branding/upstream-merge-guard.test.ts
  packages/opencode/test/upstream/bridge-merge-e2e.test.ts`:
  162 pass / 0 fail.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: anandgupta42

.github/meta/commit.txt

@@ -84,6 +84,15 @@ jobs:
       - name: Install dependencies
         run: bun install
 
+      - name: Install merge tooling deps (script/upstream)
+        # The script/upstream/ workspace is its own bun project (depends on
+        # minimatch). Root `bun install` doesn't reach it. Tests in
+        # test/upstream/bridge-merge-e2e.test.ts shell out to
+        # `bun run script/upstream/analyze.ts --branding` which requires this.
+        # Mirrors the install step in the marker-guard job below.
+        run: bun install
+        working-directory: script/upstream
+
       - name: Run tests
         working-directory: packages/opencode
         # Cloud E2E tests (Snowflake, BigQuery, Databricks) auto-skip when

.github/workflows/ci.yml

@@ -34,3 +34,11 @@ tsconfig.tsbuildinfo
 __pycache__
 *.pyc
 .venv/
+
+# Transient commit-message and PR-body templates per CLAUDE.md commit
+# workflow. Do NOT track — they're per-developer scratch files that
+# intentionally quote upstream brand strings when describing rebrand
+# fixes, and tracking them produces false-positive branding leaks.
+.github/meta/commit.txt
+.github/meta/diff.txt
+.github/meta/pr-body-*.md

.gitignore

@@ -258,10 +258,6 @@ export const defaultConfig: MergeConfig = {
     "github/README.md",
     "github/index.ts",
     "install",
-    // packages/altimate-engine/** — kept for backwards compatibility with the
-    // upstream-merge-guard regression test even though the Python engine was
-    // eliminated in commit 845ee98271. Glob matches nothing today; it'll cover
-    // the directory if anyone re-adds it.
     "packages/altimate-engine/**",
     "packages/drivers/**",
     "packages/opencode/src/altimate/**",