chore(wheelhouse): cascade template@cf15ef5a

Auto-applied by socket-wheelhouse sync-scaffolding into cascade-socket-bin-10507.
13 file(s) touched:
  - .claude/hooks/fleet/no-unmocked-network-in-tests-guard/README.md
  - .config/fleet/.markdownlint-cli2.jsonc
  - .config/fleet/oxlint-plugin/lib/fleet-paths.mts
  - .config/fleet/oxlintrc.json
  - .config/socket-wheelhouse-schema.json
  - CLAUDE.md
  - docs/claude.md/fleet/bypass-phrases.md
  - docs/claude.md/fleet/no-live-network-in-tests.md
  - scripts/fleet/check-paths/scan-code.mts
  - scripts/fleet/paths.mts
  - scripts/fleet/publish-release.mts
  - scripts/fleet/socket-wheelhouse-schema.mts
  - scripts/fleet/util/parse-args.mts

Author: jdalton

.claude/hooks/fleet/no-unmocked-network-in-tests-guard/README.md

@@ -28,5 +28,5 @@ Type `Allow unmocked-network-in-tests bypass` verbatim in a recent message.
 live `api.anaconda.org` / `hub.docker.com`, timing out at 15s. Full rationale:
 `docs/claude.md/fleet/no-live-network-in-tests.md`.
 
-Defense in depth with the fleet `test/setup.mts` (runtime `disableNetConnect()`)
+Defense in depth with the fleet `test/scripts/fleet/setup.mts` (runtime `disableNetConnect()`)
 and the CLAUDE.md rule.

.config/fleet/.markdownlint-cli2.jsonc

@@ -5,8 +5,8 @@
  *   duplicating the path string + its rationale comment. Examples of
  *   consumers:
  *
- *   - `no-file-scope-oxlint-disable` exempts `scripts/paths.mts` (deliberate
- *     flow-ordered exports, see PATHS_FILE constant below).
+ *   - `no-file-scope-oxlint-disable` exempts `scripts/fleet/paths.mts`
+ *     (deliberate flow-ordered exports, see PATHS_FILE constant below).
  *   - `socket/prefer-cached-for-loop` and `socket/no-cached-for-on-iterable`
  *     share `lib/iterable-kind.mts` for the binding-kind heuristic — sibling
  *     pattern. When a new rule needs to recognize one of these path patterns,
@@ -41,7 +41,7 @@ export function isPluginInternalPath(filename: string): boolean {
 }
 
 /**
- * True when `filename` points at the fleet-canonical `scripts/paths.mts`.
+ * True when `filename` points at the fleet-canonical `scripts/fleet/paths.mts`.
  */
 export function isPathsModule(filename: string): boolean {
   return filename.endsWith(PATHS_FILE)

.config/fleet/oxlint-plugin/lib/fleet-paths.mts

@@ -207,7 +207,7 @@ When a regex matches against a path string, **normalize the path first** with `n
 
 Never use `Bash(run_in_background: true)` for test / build commands (`vitest`, `pnpm test`, `pnpm build`, `tsgo`) — backgrounded runs you don't poll leak Node workers. Background mode is for dev servers and long migrations whose results you'll consume. Kill hangs with `pkill -f "vitest/dist/workers"`; `.claude/hooks/fleet/stale-process-sweeper/` reaps orphans on Stop. `.DS_Store` files swept at turn-end by `.claude/hooks/fleet/sweep-ds-store/` — no bypass; never wanted in a repo. When writing Bash-allowlist hooks, prefer **AST-based parsing** (via `.claude/hooks/_shared/shell-command.mts` / `findInvocation`, wraps `shell-quote`) over regex when the rule reasons about command structure — regex approves `git $(echo rm) foo.txt`; AST blocks it.
 
-🚨 Tests never connect to third-party servers — mock HTTP with `nock` (`disableNetConnect()` + stubs; `registry-*.test.mts` are canonical). Fleet `test/setup.mts` fails closed; localhost stays allowed. Bypass: `Allow unmocked-network-in-tests bypass` (enforced by `.claude/hooks/fleet/no-unmocked-network-in-tests-guard/`).
+🚨 Tests never connect to third-party servers — mock HTTP with `nock` (`disableNetConnect()` + stubs; `registry-*.test.mts` are canonical). Fleet `test/scripts/fleet/setup.mts` fails closed; localhost stays allowed. Bypass: `Allow unmocked-network-in-tests bypass` (enforced by `.claude/hooks/fleet/no-unmocked-network-in-tests-guard/`).
 
 ### Judgment & self-evaluation