test: add OA009 e2e case using examples/oa009-stale-floor fixture

Extends detectors.test.ts to cover OA009 through the real CLI binary. Uses
the existing examples/oa009-stale-floor fixture (build-tool@2.0.0 declares
semver ^7.5.4; override semver >=5.7.2 is therefore redundant). Asserts the
finding fires, package name, severity, and the remove patch. No temp directory
needed - the fixture already has the full node_modules structure.

Author: sonukapoor

tests/e2e/detectors.test.ts

@@ -20,7 +20,7 @@
 
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { runCli, mkProject, rmProject } from "./harness.js";
+import { CLI, runCli, mkProject, rmProject } from "./harness.js";
 
 /** Run `overrides <dir> --json` and return the parsed findings array. */
 function findingsFor(dir: string, extraArgs: string[] = []): any[] {
@@ -229,6 +229,20 @@ describe("e2e detectors OA001-OA008 fire through the real binary", () => {
     }
   });
 
+  it("OA009 stale floor: override floor already met by all parent declarations", () => {
+    // Uses the checked-in examples/oa009-stale-floor fixture (no temp dir needed).
+    // build-tool@2.0.0 declares "semver": "^7.5.4" (floor 7.5.4 >= 5.7.2).
+    // The override "semver": ">=5.7.2" is therefore redundant and OA009 should fire.
+    // CLI = dist/index.js; two levels up reaches the project root.
+    const dir = join(CLI, "..", "..", "examples", "oa009-stale-floor");
+    const findings = findingsFor(dir);
+    expect(ruleIds(findings)).toContain("OA009");
+    const oa009 = findings.find((f: any) => f.ruleId === "OA009");
+    expect(oa009.package.name).toBe("semver");
+    expect(oa009.severity).toBe("low");
+    expect(oa009.fix.patch).toEqual([{ op: "remove", path: "/overrides/semver" }]);
+  });
+
   it("OA008 materialized vulnerable: a copy below the floor is on disk", () => {
     // Mirror oa008.test.ts: floor >=0.28.0; top-level copy satisfies but a
     // nested copy under tsx is 0.25.12 (below the floor). The walker only